GoKawiilAzure OpenAI assistant leaked SharePoint files to low-privilege users, engineer finds
Egiziago Cioffi, CEO of Microsoft partner SynSphere Italia, discovered that an Azure OpenAI email assistant he built was returning SharePoint content to a low-privilege test account that the account could not access directly in SharePoint. The assistant had passed all evaluation scores and unit tests, but comparing outputs from a high-privilege and a low-privilege account against identical queries exposed the mismatch, revealing that retrieval was happening under the indexer's permissions rather than the requester's.
GoKawiil's interpretation of the reporting above, not reported fact.
The flaw stems from a documented fail-open default in Azure OpenAI On Your Data: if the permitted-groups field isn't mapped to Azure AI Search security filters, document-level access control is simply disabled. Since standard evaluation metrics and unit tests never probe cross-permission scenarios, similar retrieval-augmented-generation deployments elsewhere could be silently leaking sensitive documents without anyone noticing until logs are audited directly.
- Passing evaluation scores and unit tests does not guarantee an AI assistant respects user-level access permissions.
- Azure OpenAI On Your Data disables document-level access control by default if the permitted-groups field isn't mapped.
- Testing with accounts of differing privilege levels against identical prompts can expose retrieval permission leaks that standard QA misses.
Source: venturebeat.com, 2026-09-01
Published there as: “Closing an Azure OpenAI assistant's retrieval gap didn't take a new identity platform. It took one filter and a narrower assistant.”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.