Microsoft AI research storage exposed through an overly permissive Azure SAS token

An Azure Shared Access Signature (SAS) token embedded in a URL on a public GitHub repository for open-source AI models gave outside access to an internal Microsoft storage account. The Microsoft Security Response Center (MSRC) disclosed the exposure on 18 September 2023, after cloud security firm Wiz reported it in June 2023.

What happened

According to MSRC, the token was inadvertently included in a blob store URL shared in a public GitHub repository while contributing to open-source AI learning models. Wiz researchers then used the token to reach data in the storage account. TechCrunch, citing Wiz, reported that the URL granted permissions across the entire storage account, had exposed data since 2020, and allowed full control rather than read-only access. Microsoft said there was no vulnerability in Azure Storage or the SAS feature itself.

Impact

MSRC said the exposed data included workstation profile backups of two former employees and internal Microsoft Teams messages between those two people and colleagues, and that no customer data was exposed. TechCrunch, reporting Wiz findings, described 38 terabytes of sensitive information, including passwords to Microsoft services, secret keys and more than 30,000 internal Teams messages from hundreds of employees.

Response

MSRC revoked the token and blocked all external access to the account on 24 June 2023, and TechCrunch reported that Microsoft finished assessing organizational impact on 16 August. Microsoft also widened the SAS detection used by GitHub secret scanning to flag tokens with overly permissive expiry or privileges. Its own historical rescans had found this URL but wrongly marked it a false positive, a flaw Microsoft said it has since fixed. The company recommends SAS lifetimes of 1 hour or less.

Lessons for security leaders

AI research teams move large datasets and model files around quickly, and sharing links become long-lived secrets. Treat signed storage URLs like passwords: scope them to a single object, keep expiry short, and tie them to a revocable access policy. Scan public repositories your organization owns for embedded tokens, and review how scanner findings get triaged, since a genuine hit filed away as noise protects nothing.