# The Unstoppable Threat: AI Security Flaws That May Be Impossible to Fix, Plus a Deceptive Visa Portal Scamming Thousands
A new Cornell research paper delivers sobering news: prompt injection attacks on AI systems may be fundamentally unsolvable. Simultaneously, security researchers are uncovering a sprawling UK visa portal scam targeting travelers worldwide, and experts warn that hackers can now completely lock organizations out of Microsoft 365 without a single password or malicious file. The convergence of these threats illustrates a critical moment in cybersecurity: as enterprises rush to deploy AI agents across their most sensitive systems, fundamental vulnerabilities may render traditional defense strategies obsolete.
## The Threat: Three Converging Attacks
### The Fake UK Visa Portal
A sophisticated phishing operation has been quietly collecting sensitive personal data from thousands of travelers attempting to apply for UK visas. The attackers created a convincing replica of the official UK visa application portal, complete with professional design and branding. Victims unknowingly uploaded:
When a journalist contacted the operators with a vulnerability disclosure, the response wasn't a patch or remediation—it was legal threats. This defensive response through lawyers rather than security teams suggests the operators view this as a criminal enterprise rather than a misconfigured service.
### Prompt Injection: The Unfixable AI Vulnerability
Researchers at Cornell University have published findings suggesting that prompt injection attacks on large language models (LLMs) may be theoretically impossible to eliminate completely. Prompt injection occurs when an attacker embeds malicious instructions within seemingly innocuous data that an LLM ingests.
For example:
The Cornell research suggests this vulnerability is fundamentally baked into how large language models process language, making it potentially immune to conventional patching or architectural changes.
### Microsoft 365 Account Takeover Without Passwords
Security experts at CoreView have identified attack chains allowing malicious actors to completely lock organizations out of Microsoft 365 environments without requiring password theft, phishing, or malicious file execution. The attack leverages legitimate administrative functions that attackers can manipulate to revoke permissions, alter authentication rules, and sever legitimate user access entirely.
## Background and Context: Why This Matters Now
### The AI Agent Gold Rush
Enterprises are deploying AI agents at unprecedented speed. These autonomous systems can:
The urgency is understandable—AI agents promise dramatic efficiency gains. But this deployment surge is happening faster than security practices can mature. Most organizations deploying AI agents have not adequately considered prompt injection risks, particularly in high-stakes scenarios like:
### Visa Fraud as a Growing Trend
The fake UK visa portal is not an isolated incident. Similar operations have targeted:
These scams represent a shift in phishing sophistication. Rather than individual credential theft, attackers are now mass-harvesting government-issued identity documents and biometric data—information far more valuable than passwords for identity theft, fraud, and potentially state-sponsored surveillance.
### Microsoft 365 as the Enterprise Crown Jewel
Microsoft 365 controls access to email, OneDrive, SharePoint, and Teams for millions of organizations. Complete account lockout means:
This makes M365 takeover a high-impact target for both cybercriminals and nation-state actors.
## Technical Details: How These Attacks Work
### Prompt Injection in Practice
AI agents receive inputs from multiple sources. An attacker can inject malicious prompts through:
| Attack Vector | Example | Risk Level |
|---|---|---|
| Uploaded documents | PDF metadata or hidden text | High |
| Email forwarded to AI | Attacker sends email to address monitored by AI | High |
| Web scraped content | AI agent reads attacker-controlled website | High |
| User-provided data | Victim pastes attacker text into AI system | Medium |
| Third-party integrations | Compromised SaaS tool returns malicious data | Critical |
The Cornell findings suggest that because LLMs are fundamentally probabilistic engines designed to predict the next word based on pattern recognition, they cannot reliably distinguish between legitimate instructions and hidden malicious ones embedded in natural language.
### The M365 Takeover Chain
The CoreView research reveals attackers can:
1. Gain initial access (often through legitimate compromised accounts or supply chain vectors)
2. Elevate permissions using legitimate M365 administrative APIs
3. Modify conditional access policies to exclude legitimate administrators
4. Reset sign-in risk policies to block recognized devices
5. Alter mailbox forwarding rules to capture authentication tokens
6. Lock legitimate users out while maintaining attacker access
Critically, no unusual activity alerts are triggered because all actions use legitimate administrative tools.
### The Visa Portal Mechanics
The fake portal likely used:
## Implications: Who's at Risk
### Organizations Using AI Agents
Every organization deploying AI agents into sensitive workflows faces unquantified prompt injection risk. This includes:
### Travelers and Identity Theft Victims
Individuals whose data was collected by the fake UK visa portal face immediate risks:
### Microsoft 365 Administrators
Organizations without robust conditional access policies, audit logging, and access reviews are vulnerable to:
## HackWire Analysis
The Cornell prompt injection findings represent a watershed moment in AI security: we may have deployed AI agents before solving a potentially unsolvable fundamental problem. This parallels the early days of SSL/TLS, when cryptographic weaknesses were discovered years after deployment—except this time, the defense might be a moving target indefinitely.
What's particularly striking is the timing. Organizations are adding AI agents to email, file systems, and financial workflows precisely when research suggests these systems can be reliably tricked through their core mechanism. A prompt injection attack requires no zero-day exploit, no code execution, no password theft—just the ability to insert text that an LLM will process.
The visa portal scam, meanwhile, signals a maturation in phishing operations. Rather than stealing credentials (which can be rotated), attackers are harvesting government-issued identity documents and biometric data. These are extraordinarily difficult to revoke or replace, making them far more valuable on the dark web than a password. For travelers, this means the attack surface has fundamentally shifted—even if you're security-conscious, a convincing replica can bypass your defenses.
The M365 takeover research from CoreView should trigger immediate action: organizations must assume that legitimate administrative tools can be weaponized if initial access is gained. The defense isn't blocking APIs (which would break functionality)—it's robust conditional access policies, real-time anomaly detection, and audit logging with immutable retention.
For defenders, the playbook is clear: assume prompt injection is here to stay and build AI systems with human-in-the-loop verification for high-stakes decisions. Assume M365 administrators need protection beyond passwords. And assume that sophisticated phishing now targets your identity documents, not just your credentials.
— HackWire Editorial
## Recommendations
Organizations should take immediate action across three vectors:
### AI Agent Security
### Visa and Travel Fraud Prevention
### Microsoft 365 Hardening
## Related Coverage