GoKawiilTeen researcher finds unauthenticated endpoint exposing Microsoft's Titan analytics database
A teenage security researcher named Faav says he used a custom AI tool called Antares to probe Microsoft's internal Titan analytics platform and discovered an API endpoint that accepted raw SQL queries without requiring authentication. He reportedly traced subdomains and an archived configuration file via the Wayback Machine to map the database's 56 tables, which he says held roughly 17 trillion rows and 25,000 employee records.
GoKawiil's interpretation of the reporting above, not reported fact.
The finding suggests that even large, well-resourced companies can leave internal analytics systems exposed through misconfigured API endpoints, especially when some routes require authentication and others do not. It also illustrates how automated AI-assisted tools are increasingly lowering the barrier for independent researchers to uncover complex vulnerabilities that might otherwise require professional red teams.
- A researcher found an unauthenticated SQL query endpoint on Microsoft's internal Titan platform.
- The exposed database reportedly contained about 17 trillion rows and 25,000 employee records.
- The discovery relied on an AI orchestration tool and archived web data to map the system's structure.
YubiKey 5C NFC Security Key — This story is a stark reminder of how weak authentication and access controls can expose massive internal databases. A hardware security key like the YubiKey adds strong multi-factor authentication to accounts and services, making it far harder for attackers to slip through misconfigured endpoints like the one exploited here.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: tomshardware.com — Bruno Ferreira, 2026-09-28
Published there as: “Teenager hacks open Microsoft database with 17 trillion total rows and 25,000 user accounts”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.