16-Year-Old's Bug Report: 17 Trillion Microsoft Records Exposed, $5k Bounty
rez0__ · x · 2026-10-10
Researcher Faav (16) disclosed that a Microsoft internal analytics service never validated login token signatures, letting an attacker claim admin identity and run unauthorized SQL queries across an estimated 17.3 trillion stored rows. Faav only used table descriptions, metadata, and bounded samples — no customer data touched. Microsoft had editorial control over the write-up and praised the coordinated disclosure; the reported $5k bounty drew criticism. Faav built 'Antares', a personal AI hackbot that surfaced the original lead.
More from Safety
- Anthropic updates usage policy: bans sustained 'abusive or cruel behavior' toward Claude — repligate · 2026-10-10
- Beijing pilot issues ID cards for AI digital humans, complete with crypto wallets — Promptmethus · 2026-10-10
- New phishing wave on X: fake invitation links lead to spoofed x.com login page — dejavucoder · 2026-10-10
- Semafor names Altman, Huang, Nadella, Su as co-chairs of tech-policy initiative — ylecun · 2026-10-10
- Baseten launches Project Beacon with Goodfire for inline open-model safety — baseten · 2026-10-10
- Skill Constellations: first dated copy network of 2.1M agent-skill adoptions on GitHub — UBC-O · 2026-10-10