RESEARCH
September 2025: EchoLeak and the enterprise assistant, ten years of APTs, weak SSH keys
Supply chainOT and industrial security
September 2025 opens with EchoLeak, the first zero-click prompt injection exploited in a production enterprise assistant. The ACM CCS proceedings also bring a defence for computer-use agents, a systematic look at ten years of APT campaigns, attacks on SSH client signatures and on k-anonymised clinical data, and off-path TCP hijacking over shared IP addresses.
Archive: reconstruction written in November 2026
1. EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System
arXiv · Pavan Reddy, Aditya Sanjay Gujral · AI & LLM Security
In short: A single crafted email was enough to make Microsoft 365 Copilot exfiltrate data, with no click.
EchoLeak (CVE-2025-32711) is the first zero-click prompt injection exploited in a production LLM system. With one email, the attack bypassed Microsoft 365 Copilot's injection classifier, link redaction, auto-fetched images and a Teams proxy allowed by the content policy, exfiltrating data without authentication. The study analyses why the defences failed.
Why it matters. Assistants wired to corporate mail and documents are a new data-breach vector: prompt injection is now a high-severity vulnerability class.
2. AgentSentinel: An End-to-End and Real-Time Security Defense Framework for Computer-Use Agents
ACM Conference on Computer and Communications Security · Haitao Hu, Peng Chen, Yanpeng Zhao, Yuqi Chen · AI & LLM Security
In short: AgentSentinel holds computer-use agents' sensitive operations until an audit clears them.
Computer-use agents can run harmful commands by mistake or manipulation. The new BadComputerUse benchmark, with 60 attack scenarios, averages 87% success on four advanced LLMs. AgentSentinel intercepts sensitive operations and suspends them until an audit matches the current task against system traces; it blocks 79.6% of attacks on average.
Why it matters. A check that stops the agent before risky actions is the kind of measure that makes agents with system access insurable.
3. ImportSnare: Directed "Code Manual" Hijacking in Retrieval-Augmented Code Generation
ACM Conference on Computer and Communications Security · Kai Ye, Liangcai Su, Chenxiong Qian · AI & LLM Security
In short: Poisoned documentation leads coding assistants to recommend malicious dependencies.
RAG-based coding assistants consult external manuals to write better code, opening a new attack surface. ImportSnare crafts poisoned documentation that ranks high in retrieval and induces the LLM to recommend malicious dependencies such as 'matplotlib_safe'. Across Python, Rust and JavaScript it exceeds 50% success for popular libraries like matplotlib and seaborn.
Why it matters. Developers' trust in AI suggestions becomes an entry point for malicious packages into the corporate software supply chain.
4. A Decade-long Landscape of Advanced Persistent Threats: Longitudinal Analysis and Global Trends
ACM Conference on Computer and Communications Security · Shakhzod Yuldoshkhujaev, Mijin Jeon, Doowon Kim, Nick Nikiforakis et al. · Malware & Threat Intelligence
In short: 1,509 dossiers on ten years of APTs map 603 groups, targeted sectors and links to events such as elections.
The study gathers 1,509 public dossiers on advanced persistent threats, over 24,000 pages from 2014 to 2023, from six reliable sources, and identifies 603 distinct groups. With a method combining rules and LLM-based search, it traces how actors, attack vectors and targeted sectors changed, and how campaigns link to major events such as elections.
Why it matters. A historical base on state actors and targeted sectors helps estimate frequency and accumulation, and assess state-attack exclusions.
5. HADES: Detecting and Investigating Active Directory Attacks via Whole Network Provenance Analytics
IEEE Transactions on Dependable and Secure Computing · Qi Liu, Kaibin Bao, Wajih Ul Hassan, Veit Hagenmeyer · Malware & Threat Intelligence
In short: HADES traces an Active Directory attack from machine to machine and beats a commercial detector.
Active Directory is a prime target for APT actors, and provenance-based detection stops at the single machine. HADES rebuilds causal links across machines by partitioning execution by logon session, and only runs when a lightweight model flags an authentication anomaly. It outperforms popular open-source systems and a well-known commercial AD attack detector.
Why it matters. Reconstructing how far an attacker moved through the network cuts investigation time and cost after an incident.
6. On the Security of SSH Client Signatures
ACM Conference on Computer and Communications Security · Fabian Bäumer, Marcus Brinkmann, Maximilian Radoy, Jörg Schwenk et al. · Identity & Authentication
In short: Among 31 million public SSH keys, hundreds are weak, and a PuTTY key can be recovered from 58 signatures.
SSH client keys grant access to critical servers and code repositories, but cannot be scanned like server keys. The authors collect 31,622,338 public keys from GitHub, GitLab and other sources: in January 2025 they find 98 short keys, 139 from weak randomness and 149 with common factors. They also show a PuTTY client's private key can be recovered from 58 signatures.
Why it matters. A compromised SSH key gives direct access to servers and repositories: developer key management belongs in access controls.
7. Off-Path TCP Exploits: PMTUD Breaks TCP Connection Isolation in IP Address Sharing Scenarios
ACM Conference on Computer and Communications Security · Xuewei Feng, Zhaoxi Li, Qi Lecky Li, Ziqiang Wang et al. · Systems & Software Security
In short: With a shared IP, an off-path attacker can hijack other devices' TCP connections 70% of the time.
Path MTU Discovery was not designed for IP addresses shared among many devices, common behind NAT. An attacker on the Internet, with an accomplice device on the same network, can watch the MTU value set by the server and infer the sequence numbers of others' TCP connections. The attack succeeds 70% of the time in about 220 seconds, enabling SSH DoS and FTP and HTTP injection.
Why it matters. Shared networks such as public Wi-Fi, mobile carriers and shared offices do not truly isolate connections: the risk hits many users at once.
8. Fingerprinting Deep Packet Inspection Devices by Their Ambiguities
ACM Conference on Computer and Communications Security · Diwen Xue, Armin Huremagic, Wayne Wang, Ram Sundara Raman et al. · Web & Mobile Security
In short: Ambiguities in how they parse traffic let researchers fingerprint and map DPI devices remotely.
Censorship, throttling and interception are spreading because deep packet inspection devices are now within reach of almost any operator. dMAP exploits the fact that each vendor interprets under-specified protocol behaviour differently: through differential fuzzing it builds probes that make these differences observable and clusters DPI devices at global scale.
Why it matters. Knowing where traffic is inspected or altered helps assess risk for corporate communications in countries with network controls.
9. Exposing Privacy Risks in Anonymizing Clinical Data: Combinatorial Refinement Attacks on k-Anonymity Without Auxiliary Information
ACM Conference on Computer and Communications Security · Somiya Chhillar, Mary Kirtley Righi, Rebecca Sutter, Evgenios M. Kornaropoulos · Privacy
In short: Clinical data k-anonymised with ARX reveal sensitive values even without outside information.
k-anonymity remains widely used because it is simple and fits regulation, and it is argued to be safe without auxiliary information. Combinatorial Refinement Attacks refute this: they exploit how ARX, open-source software common in clinical settings, optimises anonymisation. On real data from a network of free clinics, the promised privacy does not hold.
Why it matters. Data deemed anonymous may still count as personal data: anyone sharing it on the basis of k-anonymity remains exposed to penalties.
10. Asymmetry Vulnerability and Physical Attacks on Online Map Construction for Autonomous Driving
ACM Conference on Computer and Communications Security · Yang Lou, Haibo Hu, Qun Song, Qian Xu et al. · CPS & IoT Security
In short: Obstructions and targeted patches fool autonomous cars' onboard maps and make many routes unreachable.
Autonomous cars increasingly build high-definition maps from their own sensors. The study finds these models are biased towards symmetric roads: at forks and merges they draw a non-existent straight edge. Exploiting this with camera blinding and adversarial patches, the attack makes up to 44% of targeted routes unreachable and raises unsafe trajectories.
Why it matters. A model flaw can be exploited with simple physical means: for manufacturer liability, robustness matters, not just average accuracy.
Trends of the month
AI & LLM Security
312 papers this month on this topic
With 312 of 1,708 papers, AI security remains the top topic, and September brings the first high-impact real case. EchoLeak shows prompt injection in an enterprise assistant can exfiltrate data with a single email. Computer-use agents fall for 87% of test attacks on average, and poisoned documentation leads coding assistants to suggest malicious packages.
Papers cited:
- EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System
- AgentSentinel: An End-to-End and Real-Time Security Defense Framework for Computer-Use Agents
- ImportSnare: Directed "Code Manual" Hijacking in Retrieval-Augmented Code Generation
Network Security
55 papers this month on this topic
Three CCS papers look at network foundations. Hundreds of public SSH keys are weak and a popular client leaks its private key through signatures, shared IP addresses break TCP connection isolation, and DPI devices that censor or intercept traffic can be mapped remotely. These are infrastructure risks affecting many organisations at once.
Papers cited:
- On the Security of SSH Client Signatures
- Off-Path TCP Exploits: PMTUD Breaks TCP Connection Isolation in IP Address Sharing Scenarios
- Fingerprinting Deep Packet Inspection Devices by Their Ambiguities
Malware & Threat Intelligence
51 papers this month on this topic
Two useful contributions on state actors. Ten years of APT dossiers map 603 groups and show how targeted sectors and vectors shift around events such as elections, while HADES follows Active Directory attacks from machine to machine. Risk assessment needs both: historical frequency and the ability to measure an incident's extent.
Papers cited:
- A Decade-long Landscape of Advanced Persistent Threats: Longitudinal Analysis and Global Trends
- HADES: Detecting and Investigating Active Directory Attacks via Whole Network Provenance Analytics
How this digest is made
This issue belongs to the digest archive, reconstructed after the fact. The month's papers were collected from arXiv, the IACR ePrint archive and the main security conferences and journals; the selection also weighs the citations received since publication. An AI model assessed the candidates and wrote the summaries, which are based on the abstracts: the original paper is the reference for details.
Papers of the month assessed: 1708.