This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Microsoft's AI research team accidentally exposed 38TB of sensitive data, including employee workstation backups and internal communications, due to a misconfigured Azure Shared Access Signature (SAS) token. The token, intended for sharing open-source image recognition models, was set to grant full control over the entire storage account. This incident highlights the security risks associated with managing large-scale data for AI development and the potential for supply chain attacks via malicious model injection.
Microsoft's AI research team accidentally exposed 38TB of sensitive data while publishing open-source training material on GitHub. The exposure included secrets, private keys, passwords, and internal Microsoft Teams messages. The team utilized Azure's Shared Access Signature (SAS) tokens for sharing, which were misconfigured, leading to the wide exposure of data.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
The misconfigured token granted write permissions on model files using Python's pickle format, creating a supply chain vulnerability where malicious code could be injected.
The incident directly resulted in the exposure of 38TB of private data, including personal computer backups, passwords, and internal communications of Microsoft employees.
Human
Due to a decision or action made by humans
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The leak was caused by a human error in configuring an Azure SAS token, which occurred unintentionally while sharing trained models publicly.
Microsoft's AI research team accidentally exposed 38TB of sensitive data, including backups and internal communications, due to a misconfigured Azure SAS token. While the immediate threat was mitigated by invalidating the token, the incident highlights critical security risks in managing large-scale AI data and potential model supply chain vulnerabilities.
The report does not describe the active operation or behavior of an AI system, but rather a security misconfiguration by humans sharing AI training data and models.
Minimal or No Risk: The open-source AI models being shared were for image recognition, which generally poses low or negligible risk to users and society under the EU AI Act.
The repository's purpose was to provide open-source code and AI models for image recognition, which falls under Image Classification.
The report provides a highly detailed technical analysis of the misconfiguration, the specific Azure features involved, the exact volume of data exposed, and a clear timeline of discovery and mitigation. Microsoft's confirmation of the issue further solidifies the credibility of the information.
None. The event is clearly a cloud security misconfiguration leading to data exposure.
Technology
Flawed SAS Token Design
Tokens are created client-side and lack centralized tracking in Azure.
Insecure Pickle Model Format
TensorFlow ckpt files use pickle, allowing arbitrary code execution.
Difficult Token Revocation
Revocation requires rotating the account key, affecting all other tokens.
Data Inputs
Co-mingled Storage Account
Public AI datasets were stored alongside private workstation backups.
Massive Training Datasets
AI research requires handling massive datasets, increasing exposure risks.
Human Factors
Overly Permissive Token Config
Developers configured full control instead of read-only access.
Excessive Token Expiry Date
Developers configured the token to expire in the year 2051.
Wide Token Scope Selection
Developers shared the entire storage account instead of specific files.
Process and Methods
Inadequate Secret Scanning
Lack of automated scanning to detect leaked SAS tokens in GitHub.
Lack of Storage Account Logging
Storage logging was not enabled, preventing detection of active token use.
Poor External Sharing Process
Account SAS was used for external sharing instead of safer alternatives.
Management
Lack of Security Visibility
Security teams lacked visibility into AI research and development processes.
No CSPM Policies Enforced
Management failed to enforce policies to disable SAS token usage.
No Dedicated Public Storage
Management did not mandate separate accounts for public and private data.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
