v2026.06

Content v2026.06

Techniques

• Added new techniques

  • Steal Web Session Cookie
  • Use Alternate Authentication Material: Web Session Cookie
  • AI Service Web Interface

• Updated existing techniques

  • LLM Jailbreak

Mitigations

• Updated existing mitigations

  • Generative AI Guardrails
  • Generative AI Guidelines
  • AI Telemetry Logging

Case Studies

• Added new case studies

  • Storm-2139 Azure OpenAI Guardrail Bypass
  • Google Photos AI Model Extraction
  • EchoLeak: Zero-Click Prompt Injection Targeting M365 Copilot for Data Exfiltration
  • Cross-Site Scripting via Prompt Manipulation in Lenovo’s AI Chatbot
  • AI in the Middle: Web-Based AI Services as C2 Relays
  • RCE Vulnerability in Semantic Kernel Search Plugin