Data accidentally exposed by Microsoft AI researchers (wiz.io)

Article summary

Microsoft AI researchers accidentally exposed 38TB of private data, including internal Microsoft Teams messages and employee workstation backups, due to a misconfigured SAS token on GitHub. The token was meant to share open-source training data but instead granted access to the entire storage account. This incident highlights the security risks associated with AI data sharing and the importance of proper access controls. The exposure was discovered by Wiz Research, which scanned the internet for misconfigured storage containers.

Main themes

• AI data security
• Cloud storage risks
• SAS token vulnerabilities
• Access control and monitoring
• Security protocols in AI development
• Complexity of cloud storage and AI processes

What commenters say

• The ease of creating SAS tokens and their lack of auditing capabilities make them a significant security risk.
• The use of SAS tokens for external sharing is unsafe and should be avoided due to their potential for overly broad access and lack of monitoring.
• The increasing complexity of cloud storage and AI development processes makes it harder to ensure security and avoid data exposure incidents.
• Proper security protocols and access controls are essential for preventing data breaches, especially in the context of AI research and development.
• The incident highlights the need for security teams to be more involved in the AI development process to mitigate potential security risks.
• Some argue that security through obscurity is not a reliable method for protecting sensitive information, while others believe it can be effective in certain contexts.