Microsoft has uncovered an AI vulnerability that could have significant repercussions for contact centers.
Dubbed ‘Whisper Leak’, the flaw could allow bad actors to discern what someone is discussing with an AI chatbot, such as ChatGPT.
‘But what about the encryption?’, I hear you cry! Worryingly, this weakness bypasses encryption entirely; or rather, it makes the encryption redundant.
According to Microsoft Defender Security Research Team, the Whisper Leak vulnerability allows an attacker who can observe network traffic to infer the topic of an encrypted AI chatbot conversation – even though the content remains unreadable.
That means that while the words remain behind TLS encryption, the patterns of data packets – including their size and timing – reflect the rhythm of the chat and can reveal sensitive subjects.
By analyzing this information and comparing many conversations about specific topics, such as “money laundering,” against unrelated ones, attackers were able to train a classifier to spot the unique patterns associated with each subject.
This resulted in Microsoft’s system being able to achieve more than 98 percent accuracy in distinguishing sensitive topics purely from the shape and rhythm of the encrypted traffic.
While no content is ever directly exposed, experts say the pattern data alone could, in theory, reveal what a user is discussing
According to official guidance, this makes the threat “practical” in environments where a well-resourced adversary could monitor encrypted traffic.
But what exactly does this mean for contact centers?
What Contact Centers Need to Know
Given the ubiquitous nature of AI-powered chatbots in contact centers in recent times, this could prove to be hugely problematic.
Indeed, WifiTalents’ 2025 Contact Center Statistics report revealed that 54% of contact centers have reported increased use of chatbots.
A report from Emerge Haus released earlier this year stated that 52% of contact centers have invested in ‘conversational AI’ and an additional 44% intend to.
Elsewhere, Calabrio’s State of the Contact Center report found that 98% of contact centers report using AI in some form.