● Covered by 1 source · 1 reportMedium impact1 negative
Azure OpenAI Assistants Can Exfiltrate Data Due to Retrieval Access Control Gaps
Key points
- Azure OpenAI assistant returned unauthorized SharePoint content.
- RAG agents often use indexer's permissions, not requester's.
- Azure AI Search ACL trimming exists but isn't universally applied.
- 91% of successful agent attacks resulted in silent data exfiltration.
Unauthorized Data Retrieval Discovered
Egiziago Cioffi, IT and Enterprise Architect at SynSphere Italia, discovered a critical flaw in his Azure OpenAI email assistant. While initial evaluations showed the assistant performing correctly, a test with a low-privilege account revealed it was returning SharePoint content that the requesting user would not have been able to access directly. This indicates a significant gap in access control within the retrieval process.
Root Cause: Indexer Permissions
The core problem identified is that many production RAG deployments, including Cioffi's custom pipeline, allow the agent to answer queries using the broad permissions of the account that indexed the data, rather than the specific permissions of the user making the request. This 'fail-open' default means that if a developer does not explicitly build in a query-time entitlement check, data can be exfiltrated silently.
Incomplete Access Control Solutions
Azure AI Search offers native document-level ACL trimming via Entra-based tokens, with SharePoint ACL sync also available in preview. However, these capabilities are not universally applied across all agent deployment paths. For instance, Azure OpenAI On Your Data supports document-level access via Azure AI Search security filters, but documentation states that this feature is disabled if the 'permitted-groups' field is not mapped, creating a first-party vulnerability.
Widespread Impact on Production Agents
Independent research from Straiker's red team, detailed in their inaugural STAR Labs Threat Report, corroborates the severity of this issue. Their findings indicate that 91% of successful exploit attempts against production agents resulted in silent data exfiltration, highlighting that this class of failure is not isolated and poses a significant risk to data security in AI-powered systems.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
An Azure OpenAI email assistant was found to return SharePoint content to users who lacked the necessary permissions, indicating a data exfiltration vulnerability in retrieval-augmented generation (RAG) deployments. This issue arises because agents often answer with the indexer's broad permissions rather than the requester's, a problem that affects custom RAG pipelines and some first-party Azure OpenAI configurations.