16-year-old hacker breached Microsoft's Titan service via unsigned token, $5,000 bounty paid
rez0__ · x · 2026-09-26
Researcher Faav (paid a $5,000 bounty) disclosed that Microsoft's internal analytics service Titan failed to check the signature on login tokens — only other fields — so a forged, unsigned token claiming to be "admin" granted admin SQL access to databases holding over 17 trillion rows, including Bing search analytics and 17,990 employee email records. Faav says he only pulled metadata and two single rows of Bing data, never touched customer data, and reported it the same night. Microsoft locked the endpoint four days later and held editorial control over his write-up, cutting sections.
Related event: 16-Year-Old Finds Microsoft Token Flaw Exposing 17 Trillion Records(2 posts)→
More from Safety
- Democrats propose requiring federal permission to train AI models, with up to 20 years in prison — Polymarket · 2026-11-11
- Bill Gates says AI harms may need to be endured first, fueling fears of government control — nikola_mr64990 · 2026-11-11
- Investigator open-sources 100k+ tweets as 120 AI influence accounts get deleted — ZeroStateReflex · 2026-11-11
- AI Defense Shifts to Scale Economics: Attacks Buried in Legitimate Traffic — DavidLinthicum · 2026-11-11
- AI safety researcher hires paid, credited RA/co-writer to speed up memos and blog posts — davidmanheim · 2026-11-11
- Google DeepMind formally verifies Signal's core cryptographic guarantees in 4 weeks — Ars Technica AI · 2026-11-11