Microsoft AI researchers accidentally expose 38TB of internal data

AI researchers love open source, but sometimes they share far more than intended.

Cloud security startup Wiz just revealed that Microsoft’s AI research team accidentally exposed 38 terabytes of sensitive internal data while publishing an open-source image recognition model on GitHub.

The leak was massive. It included full computer backups belonging to two Microsoft employees, private cryptographic keys, passwords to internal Microsoft services, and over 30,000 internal Microsoft Teams messages from hundreds of staff members.

Full access left open for three years

To help developers download training data and models, Microsoft researchers provided an Azure Storage URL in their GitHub repository. The link relied on a Shared Access Signature, or SAS token, which allows users to share direct access to Azure files.

The problem? Instead of restricting access to read-only for specific files, the researchers misconfigured the SAS token to grant full control over the entire storage account.

That meant anyone with the link could do far more than just peek at private chats. They had permission to view, delete, overwrite, and inject malicious code directly into the hosted files.

Worst of all, Wiz found that this misconfigured URL had been sitting publicly in the GitHub repository since 2020.

Microsoft’s fix and expanded scanning

Wiz notified Microsoft on June 22. Microsoft revoked the faulty token two days later on June 24, and wrapped up its internal investigation on August 16.

According to Microsoft’s Security Response Center, no customer data was compromised, and no other internal systems were breached.

To prevent similar blunders, Microsoft announced it expanded GitHub’s automated secret scanning service. The system will now flag SAS tokens that carry overly permissive access or excessively long expiration dates in open-source repositories.

Why it matters

This incident shines a harsh light on a massive blind spot in the modern AI pipeline.

Data scientists and machine learning engineers are moving lightning fast to train and release new models. But as Wiz pointed out, teams dealing with petabytes of data often lack basic cloud security hygiene. When sharing massive files on public hubs, granular permission management easily falls through the cracks.

We think the scariest part of this leak isn't the exposed Teams chats, but the risk of AI supply chain poisoning. Because the storage bucket had full write access for three years, a malicious actor could have quietly swapped out the open-source model weights with compromised files, poisoning any downstream project that imported them.

Microsoft expanding GitHub's secret scanning looks like a solid defense mechanism. Still, for developers and organizations rushing to build AI applications, this is a clear warning sign: before pushing your next breakthrough model, check who actually holds the keys to your data.