A teenager identified as Faav discovered a vulnerability in a Microsoft database using a custom AI bot named Antares. The bot scanned subdomains and identified an Azure Cloud host with an exposed API endpoint that did not require authentication for specific queries.
The researcher utilized a 2023 configuration file from the Wayback Machine to understand the database schema. He bypassed security protocols by exploiting a lack of JWT token validation, allowing him to gain unauthorized access to the system by mimicking administrator credentials.
The breach exposed 25 000 user accounts and a total of 17 trillion records, including Bing analytics data, organization records, and internal dashboards. The researcher reported the flaw through the official Microsoft bug bounty program.
Following the disclosure, Microsoft awarded the researcher $5 000 for identifying the security gap. The teenager noted that the discovery was made possible by combining his own intuition with the automated scanning capabilities of his AI tool.
