16-year-old's AI-assisted bug hunt exposed 17.3 trillion Microsoft records via unsigned token
rez0__ · x · 2026-09-26
16-year-old bug bounty researcher Faav disclosed that a Microsoft internal analytics service never validated login token signatures, leaving an estimated 17.3 trillion stored rows reachable by forging an admin identity and submitting unauthorized SQL queries. No customer data was touched; Microsoft fixed the flaw, thanked Faav, and held editorial control over the write-up. Notably, the lead originally came from Antares, his personal AI hackbot, with the human finishing verification ten days later.
Related event: 16-Year-Old Finds Microsoft Token Flaw Exposing 17 Trillion Records(2 posts)→
More from Safety
- Chinese University Bought Nvidia H200 Chips Despite US Blacklist — pstAsiatech · 2026-11-11
- Google employee shows a way to get past an AI safety filter — adonis_singh · 2026-11-11
- Researcher Warns Real-Time Video AI Companions Are the Next Teen-Safety Wave — anshulkundaje · 2026-11-11
- China gives AI agents digital identities — but enforcing permission boundaries is the hard part — Shufti-Global · 2026-11-11
- 35,000+ Grok-built apps exposed patient data, plaintext passwords, and sales pipeline — The Decoder · 2026-11-11
- Fortinet patches nearly 100 vulnerabilities after adding AI models to security testing — Potential-Couple-745 · 2026-11-11