Microsoft Titan platform vulnerability exposed by teenage researcher

A 16-year-old security researcher known as Faav discovered a vulnerability in Microsoft’s internal analytics platform, Titan, using an AI-based orchestration tool he developed called Antares. The flaw involved a failure to properly verify cryptographic signatures on JSON Web Tokens (JWT), allowing for unauthorized access to an API.

The vulnerability theoretically provided access to databases containing approximately 17.3 trillion rows of data and 25,000 employee accounts. However, the researcher stated that no data was stolen or downloaded; instead, the activity was limited to analyzing metadata, table descriptions, and small samples to demonstrate the risk.

Microsoft has since patched the exposure and rewarded the researcher with a $5,000 bug bounty. The discovery highlights ongoing risks associated with improper JWT implementations, a known security issue in the industry.