Microsoft Patches Critical AI Protocol Flaw After Researcher Warning

Security researchers Aonan Guan and Lei Wang discovered a critical path traversal vulnerability in Microsoft's Natural Language Web (NLWeb) project. The protocol, designed to make websites queryable via natural language, contained a flaw allowing remote users to access sensitive system configuration files and API keys for large language models such as GPT-4 and Gemini through malformed URLs.

Guan characterized the potential leak of API keys as "catastrophic," noting that attackers could steal an AI agent's cognitive capabilities to create malicious clones or cause financial loss. The vulnerability affected early deployments for customers including Shopify, TripAdvisor, and Eventbrite.

Microsoft patched the flaw on July 1, 2025, following a notification on May 28, but declined to issue a Common Vulnerabilities and Exposures (CVE) identifier. While Microsoft stated that customers using the open-source repository are automatically protected, Guan argued that users must manually pull a new build version to eliminate the risk.