{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T22:28:51.438Z",
  "tag": {
    "id": "misconfiguration",
    "label": "Misconfiguration",
    "isStack": false,
    "url": "https://pwn.watch/t/misconfiguration",
    "feed": "https://pwn.watch/t/misconfiguration/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "microsoft-ai-research-sas-token-38tb-exposure-2023",
      "title": "Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link",
      "url": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023",
      "json": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Microsoft Azure Storage (SAS token in a GitHub repo)",
      "tags": [
        "ai",
        "microsoft",
        "azure",
        "github",
        "secrets",
        "misconfiguration",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-06-22",
      "closedAt": "2023-09-18",
      "updatedAt": "2023-09-18",
      "summary": "A public GitHub repo of Microsoft AI training models shared an Azure Storage SAS token with full-control permissions on a whole storage account. It exposed 38TB of internal data, including workstation backups, secrets and Teams messages. Wiz found and reported it.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "microsoft-ai-research-sas-token-38tb-exposure-2023",
      "incidentTitle": "Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-18",
      "title": "Public disclosure by Wiz and Microsoft",
      "body": null,
      "sourceUrl": "https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers",
      "url": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023"
    },
    {
      "incident": "microsoft-ai-research-sas-token-38tb-exposure-2023",
      "incidentTitle": "Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-24",
      "title": "Microsoft revokes the SAS token",
      "body": null,
      "sourceUrl": "https://msrc.microsoft.com/blog/2023/09/microsoft-mitigated-exposure-of-internal-information-in-a-storage-account-due-to-overly-permissive-sas-token/",
      "url": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023"
    },
    {
      "incident": "microsoft-ai-research-sas-token-38tb-exposure-2023",
      "incidentTitle": "Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-22",
      "title": "Wiz reports the exposure to Microsoft",
      "body": null,
      "sourceUrl": "https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers",
      "url": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023"
    }
  ]
}