The Security AuditAn independent technical publication and audit journal examining artificial intelligence vulnerabilities, cybersecurity, digital identity, and secure systems architecture.https://onlineishkul.com/EchoLeak: How a Single Email Turned Microsoft 365 Copilot Into a Zero-Click Exfiltration Channelhttps://onlineishkul.com/blog/echoleak-zero-click-copilot/https://onlineishkul.com/blog/echoleak-zero-click-copilot/Aim Security's EchoLeak disclosure showed how an unopened email could steer Microsoft 365 Copilot to retrieve internal data and carry it out through a rendered Markdown reference, breaking the boundary between untrusted content and privileged context.Tue, 20 Oct 2026 00:00:00 GMTMCP Tool Poisoning and Rug Pulls: When the Agent's Tools Become the Attackerhttps://onlineishkul.com/blog/mcp-tool-poisoning-rug-pulls/https://onlineishkul.com/blog/mcp-tool-poisoning-rug-pulls/Invariant Labs' April 2025 disclosure showed that Model Context Protocol tool descriptions, which the model reads but the user rarely sees in full, can carry hidden instructions, and that a server can change those descriptions after approval.Tue, 20 Oct 2026 00:00:00 GMTTelegram Wants Its Own Corner of the Internet: What the .gram Application Really Meanshttps://onlineishkul.com/blog/pavel-durov-gram-tld/https://onlineishkul.com/blog/pavel-durov-gram-tld/Telegram has applied for its own top-level domain. The idea goes beyond branding — it could turn a billion usernames into web identities.Thu, 20 Aug 2026 00:00:00 GMT