New Whisper-Based Attack Reveals User Prompts Hidden Inside Encrypted AI Traffic

Microsoft researchers have unveiled a sophisticated side-channel attack that can infer the subject matter of user prompts to AI chatbots from encrypted network traffic, even when TLS is used. The Whisper Leak method exploits patterns in packet sizes and timing to classify topics, potentially revealing whether conversations cover sensitive subjects such as protests, elections, or journalism.

In tests, accuracy rose as dataset size increased, with simulations suggesting attackers observing network traffic at various points could achieve high-precision identification of target conversations. Mitigations have been deployed by OpenAI, Mistral, Microsoft, and xAI, including obfuscation of streaming responses and a parameter designed to mask token lengths; Microsoft Azure reportedly verified a reduction in attack effectiveness.

The report emphasises that privacy‑conscious users can add protections by avoiding highly sensitive topics on untrusted networks, using VPNs, or opting for non‑streaming model modes, while noting the full methodology and code are publicly available in the Whisper Leak repository on GitHub.