A teenage security researcher who goes by Faav gained access to Microsoft's internal Titan analytics platform, exposing a database with roughly 17 trillion rows and 25,000 employee records. The researcher reported the flaw to Microsoft's bug bounty program and received $5,000.
Faav used an AI orchestrator bot named Antares to scan for endpoints. The bot found a Swagger/OpenAPI file listing four routes; three required Azure Active Directory authentication, but one, /v2/Query, did not. It accepted raw SQL queries. Faav used the Wayback Machine to recover a 2023 configuration file that described the database schema, including 56 tables.
The endpoint initially rejected queries without a JWT, but Faav realized the server was not checking the token's digital signature. By forging an administrator token, he was able to run SHOW DATABASES and access employee data, dashboards, and a Bing analytics data source totaling 17 trillion rows across tables.
In his write-up, Faav credited both AI automation and human intuition: Antares did ten days of scanning work, while the hunch about the missing signature check came from him. The case illustrates how AI-assisted reconnaissance can uncover flaws that might otherwise go unnoticed.