Hackers bypassed Microsoft Azure OpenAI safeguards to generate abusive content
Microsoft detected a global cybercriminal network called Storm-2139 that obtained customer credentials and used them to bypass safety guardrails on Azure OpenAI services to generate non-consensual sexual images of celebrities and other abusive content, which they sold access to for a profit. Microsoft has referred the matter to law enforcement and stated it is strengthening security measures.
What happened
Microsoft announced it detected hackers based in the United States, Iran, the United Kingdom, Hong Kong, and Vietnam who bypassed safety guardrails in AI production tools, including Azure OpenAI, to generate harmful content including non-consensual celebrity images and other sexual content.
The hackers obtained customer credentials from public sources, used them to access AI production services, modified the capabilities of AI products, and sold access to other malicious groups along with instructions on how to create abusive content.
Reported impact
The abusive images created had serious and permanent impacts on victims, according to Microsoft's Digital Crimes Unit assistant general counsel Steven Masanta.
Index analysis
The attackers were part of a global cybercriminal network called Storm-2139, with members identified in Florida and Illinois whose names Microsoft withheld to avoid compromising criminal investigations.
Governance controls
Microsoft said it is preparing criminal referrals to US and foreign law enforcement authorities.
Microsoft stated it remains committed to protecting users by incorporating strong AI security measures in its platforms and protecting services from illegal and abusive content.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.