GoKawiilAzure OpenAI assistant leaked SharePoint files to low-privilege users, engineer finds
Egiziago Cioffi, CEO of Microsoft partner SynSphere Italia, discovered that an Azure OpenAI email assistant he built was returning SharePoint content to a low-privilege test account that the account could not access directly in SharePoint. The assistant had passed all evaluation scores and unit tests, but comparing outputs from a high-privilege and a low-privilege account against identical queries exposed the mismatch, revealing that retrieval was happening under the indexer's permissions rather than the requester's.