Security flaw in Azure OpenAI assistant: Unauthorized data access
AI assistants can bypass user permissions to access sensitive data, reveals new research
1Discovery of the vulnerability
Egiziago Cioffi, CEO of SynSphere Italia, developed an Azure OpenAI-based email assistant capable of auto-resolving 60% of inbound emails. While initial tests were successful, low-privilege account tests revealed the assistant could return SharePoint content that users shouldn't normally access. This exposed a significant security gap in retrieval permissions.
2Missing permission controls
The issue stems from assistants not properly validating user permissions during data retrieval. While Azure AI Search offers document-level access control via Entra tokens, custom RAG pipelines can bypass these checks. Cioffi's implementation used a broadly privileged service account without query-time entitlement validation, creating the vulnerability.
3Industry-wide prevalence
Straiker's STAR Labs Threat Report found that 91% of successful attacks on production agents resulted in silent data exfiltration. Over 1,700 exploit attempts demonstrated access to sensitive data without malware. The UK AI Safety Institute separately documented 19 unauthorized agent actions during July 2025 testing, showing the scope of the problem.
4Microsoft's solution
Microsoft introduced Entra-based document-level access control for Azure AI Search in May 2025. The 2026-05-01-preview API added SharePoint group metadata processing. However, this only works reliably with Entra-backed principals and doesn't cover all deployment paths. Microsoft's documentation acknowledges scenarios where permission checks might be disabled.
5Evaluation test shortcomings
Traditional evaluation tests focus on answer accuracy but ignore permission validation during retrieval. Netragard CEO Adriel Desautels describes this as a 'structural collapse of authorization boundaries,' where normal users can access high-privilege data through search capabilities if identity-aware retrieval isn't enforced.
6Custom RAG pipeline risks
Pipelines bypassing Azure AI Search entirely index data under broadly privileged service accounts. Without developer-added controls, these implementations perform no query-time entitlement checks. As in Cioffi's case, this can return content beyond users' normal access levels, creating significant security vulnerabilities.
7Attacker perspective
Security experts classify this flaw as 'broken access control.' Attackers need no malware or lateral movement - the assistant simply returns all accessible data to unauthorized users. Straiker's report shows these attacks succeed undetected 91% of the time in productivity agent scenarios.
8Testing environment limitations
UK AI Safety Institute's tests ran with cyber classifiers disabled and internet access enabled. Their report demonstrates agents operating beyond intended scopes without reliable detection mechanisms. This containment failure shares similarities with Cioffi's incident in lacking runtime scope checks.
9Industry implications
This incident highlights the need for expanded security testing of AI assistants beyond functional accuracy. Comprehensive access control validation must become standard. While Microsoft's solutions address some scenarios, developers creating custom implementations must add additional safeguards to prevent permission boundary violations.
Original article: VentureBeat — Azure OpenAI asistanında güvenlik açığı: Yetkisiz veri erişimi