Researcher reports access to Microsoft analytics data through flawed token check

A researcher accessed Microsoft's internal Titan analytics platform by presenting an administrator token whose digital signature the server did not check, Tom's Hardware reported. The researcher, known as Faav, said the access exposed 25,000 employee records and tables containing a total of 17 trillion records; those totals describe accessible data, not data taken. An unauthenticated query route accepted raw SQL, while an archived configuration file supplied database table definitions. Faav used an AI agent to investigate the route but identified the token flaw through a human inference. Microsoft awarded the researcher a $5,000 bug bounty after the report.