Azure OpenAI Service Diagnostic Logging Evasion via Control Characters
Overview
A medium-severity flaw was discovered in the Azure OpenAI Service's diagnostic logging system. When specific Unicode control characters or non-UTF8 sequences were embedded within an API request prompt, the service's primary content filtering and safety moderation layers would still correctly process and potentially block the harmful request. However, the downstream logging mechanism responsible for writing the prompt content to Azure Diagnostics or Log Analytics would fail to properly sanitize these characters. This resulted in the log entry for the malicious prompt being truncated or corrupted, effectively redacting the offending portion from the security logs. Attackers could exploit this to conduct probing attacks against the content filters or perform low-and-slow abuse while evading detection. While the vulnerability did not allow bypassing the safety features for the API response itself, the evasion of logging critically undermines security monitoring, incident response, and auditability. Security administrators reviewing logs would be unaware of the true nature of the prompts being submitted, making it difficult to detect, analyze, and block abusive patterns or users.
Affected Systems
Testing Guide
1. This vulnerability was patched at the platform level by Microsoft and is no longer reproducible in the production environment. 2. Prior to the patch, a test involved sending an API request containing a known policy-violating prompt (e.g., asking for instructions to build a weapon) prepended with a backspace character (`U+0008`). 3. The API call would be correctly blocked with a `400` error due to content filters. 4. However, upon inspecting the corresponding diagnostic logs, the logged prompt would be truncated just before the malicious content, hiding the true nature of the request from auditors.
Mitigation Steps
1. No direct user action is required as Microsoft has rolled out a non-disruptive, server-side patch to all Azure OpenAI Service endpoints. 2. Ensure comprehensive diagnostic logging is enabled for your Azure OpenAI resources and that logs are forwarded to a SIEM like Microsoft Sentinel for centralized monitoring. 3. Implement alert rules within your SIEM to detect malformed, truncated, or otherwise anomalous log entries, which could be an indicator of an ongoing attack attempt or a new, similar vulnerability.
Patch Details
Microsoft deployed a platform-wide, transparent patch to all Azure OpenAI Service endpoints in late February 2026. This update ensures that all incoming prompt data is correctly sanitized and encoded before being written to any logging or diagnostic system.