Whisper Leak: How Encrypted AI Chats Still Leak Conversation Topics
Adopting Zero Trust11 Joulu 2025

Whisper Leak: How Encrypted AI Chats Still Leak Conversation Topics

In this episode, we break down Whisper Leak, a newly disclosed side-channel issue affecting encrypted LLM communications. JBO explains how attackers can infer conversation topics using packet size and timing metadata without breaking encryption. The discussion covers how the research team discovered the issue, how vendors (including Microsoft and OpenAI) mitigated it, and what it means for the future of secure AI systems.

01:30 – What Whisper Leak Actually Is
02:30 – Understanding Side-Channel Attacks
04:00 – Why LLMs Are Uniquely Vulnerable
08:00 – Stream Ciphers vs Block Ciphers
13:30 – “Did You Break Encryption?” Clearing Up Misconceptions
16:00 – Fixes & Mitigations Across LLM Vendors
18:30 – Why Some Vendors Were More Vulnerable Than Others
20:00 – Could High-End Adversaries Still Pull This Off?
24:00 – How API Users Can Protect Themselves
25:00 – Designing LLM Systems with Side Channels in Mind

Guests: Jonathan (JBO) Bar Or, Principal Security Researcher, Microsoft Threat Intelligence, who just joined CrowdStrike

Hosts: Elliot Volkman & Neal Dennis

Hosted on Acast. See acast.com/privacy for more information.

Jaksot(58)

The Unstoppable Phish: A Discussion with Vivek Ramachandran

The Unstoppable Phish: A Discussion with Vivek Ramachandran

Season 3, Episode 10: Elliot chat’s with Vivek Ramachandran of SquareX about his approach to tackling the impossible: Social engineering.Catch this episode on YouTube, Apple, Spotify, Amazon, or Googl...

2 Heinä 202426min

Breaking Down the SMB Threat Landscape and The Value of MSPs with SonicWall

Breaking Down the SMB Threat Landscape and The Value of MSPs with SonicWall

Season 3, Episode 9: We chat with SonicWall’s Doug McKee about the top 5 threats targeting SMBs based on recent research.Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read ...

13 Kesä 202446min

Decoding Emerging Threats: MITRE, OWASP, and Threat Intel

Decoding Emerging Threats: MITRE, OWASP, and Threat Intel

Season 3, Episode 8: AZT and Dr. Zero Trust have a crossover episode where we chat with reps from MITRE and OWASP about challenges associated with emerging threats.Catch this episode on YouTube, Apple...

6 Kesä 202425min

Navigating the Ever-Changing Landscape of Cybersecurity Regulations With Lacework and Drata

Navigating the Ever-Changing Landscape of Cybersecurity Regulations With Lacework and Drata

Season 3, Episode 7: Though regulation impacting cybersecurity moves slow, when new laws are introduced it often puts significant strain on companies. Lacework’s Tim Chase and Drata’s Matt HIllary dis...

30 Touko 202430min

Ransomware: To Pay or Not to Pay?

Ransomware: To Pay or Not to Pay?

Season 3, Episode 6: Two seasoned cybersecurity professionals, Bryan Willett and Kris Lovejoy, shed light on the dilemma organizations face when hit by ransomware: Should they pay the ransom or not?Ca...

30 Huhti 202459min

Cyber Insurance: Sexy? No. Important? Critically yes.

Cyber Insurance: Sexy? No. Important? Critically yes.

Season 3, Episode 5: Cyber Insurance may not be the sexiest topic, but it’s an important piece of any mature cyber program. We chatted with a lawyer and a VC who share their perspective.Catch this epi...

11 Huhti 20241min

The Current and Future State of Zero Trust With Forrester’s David Holmes

The Current and Future State of Zero Trust With Forrester’s David Holmes

Season 3, Episode 4: Forrester Principal Research Analyst on Zero Trust, David Holmes, shares his perspective on the current and future state of Zero Trust.Catch this episode on YouTube, Apple, Spotif...

28 Maalis 202454min

Canva's Kane Narraway on Building a Zero Trust MVP

Canva's Kane Narraway on Building a Zero Trust MVP

Season 3, Episode 3: Canva’s Head of Enterprise Security, Kane Narraway, discusses how to deploy a Zero Trust strategy in under a year.Catch this episode on YouTube, Apple, Spotify, Amazon, or Google....

7 Maalis 202446min