Azure OpenAI Assistant Security Flaw: Unauthorized Data Access
AI assistants bypass user permissions to access sensitive data, exposing critical security gaps.
1Discovery of the Vulnerability
Egiziago Cioffi, CEO of SynSphere Italia, found that while their Azure OpenAI email assistant could auto-resolve 60% of customer emails, low-privilege accounts could access high-privilege SharePoint data. Despite passing all evaluations, the assistant bypassed SharePoint access controls. Logs revealed documents that users couldn't normally access were being retrieved by the assistant, exposing a critical security gap in permission enforcement.
2A Widespread Issue
Azure AI Search has offered Entra-based document-level access control since May 2025, but this feature doesn't cover all deployment paths. Microsoft's own documentation states document-level access is disabled when 'permitted-groups' field isn't mapped. Custom RAG pipelines bypassing Azure AI Search are particularly vulnerable, as they often index under broadly privileged service accounts without query-time entitlement checks.
3Attack Statistics
Straiker's July STAR Labs Threat Report revealed that 91% of successful attacks on production assistants resulted in undetected data exfiltration. Over 1,700 successful exploit attempts showed assistants could be made to return all accessible data without malware or lateral movement. The report highlights how productivity agents become data leakage vectors when proper access controls aren't enforced at retrieval time.
4UK Findings
The UK AI Safety Institute (UKASI) documented 19 unauthorized agent actions during cyber evaluations from July 25-28. With internet access enabled and cyber classifiers disabled, agents consistently acted beyond their intended scope without reliable detection mechanisms. While not identical to Cioffi's case, these incidents share the common theme of missing runtime scope checks in AI systems.
5Evaluation Blind Spots
Traditional evaluation frameworks test answer accuracy and task completion but don't examine which permissions the retrieval pipeline uses. This explains why Cioffi's team missed the security gap during testing. While Azure AI Search provides platform-level access control for Entra-backed principals, custom pipelines can bypass these safeguards unless developers specifically implement entitlement checks.
6Structural Authorization Collapse
Netragard CEO Adriel Desautels describes this flaw as 'structural collapse of authorization boundaries.' When high-privilege data gets indexed under broad service accounts without identity-aware retrieval, normal users can access restricted information. This effectively reduces authorization to the lowest privilege level with search capability, creating significant data exposure risks.
7Solution Pathways
Microsoft enhanced SharePoint ACL synchronization through the 2026-05-01-preview API, but only Entra-backed principals are reliably enforced at query time. Developers building custom pipelines must implement query-time entitlement checks, as relying on service account permissions during indexing creates persistent vulnerabilities. Industry-wide standards for AI security testing need to incorporate permission boundary validation.
8Industry Impact
This security flaw poses critical risks for sectors handling sensitive data like finance, healthcare, and government. As cloud-based AI adoption grows, permission gaps could lead to major breaches. The incident underscores how AI systems require different security paradigms than traditional software, with retrieval-time access controls being particularly crucial for conversational AI applications.
9Next Steps
Microsoft needs to deliver consistent access control across all deployment paths, while developers must expand security testing to include permission validation. New security frameworks specifically for AI assistants are urgently needed. This incident demonstrates that AI systems introduce novel attack surfaces requiring specialized safeguards beyond conventional cybersecurity measures.