Cross-Tenant Data Exfiltration in Azure AI Studio via Inference API Cache Poisoning
Overview
Researchers at a cloud security firm discovered a critical vulnerability in the Azure AI Studio's managed inference endpoints for large language models. The vulnerability stemmed from an architectural flaw in the multi-tenant infrastructure that handles real-time inference requests. The underlying caching mechanism, designed to optimize performance by reusing GPU memory allocations and model layers for concurrent requests, failed to properly isolate data between tenants. A malicious actor with an account on the platform could send a specially crafted, malformed inference request immediately after a victim's request was processed. This crafted request would trigger an error condition that caused the server to return a raw memory buffer containing remnants of the previous inference job, which could include the victim's proprietary prompts, sensitive data passed to the model, and the model's output. The attack did not require any authentication to the victim's account, only an account on the same shared cluster. This vulnerability exposed highly sensitive business data, personal identifiable information (PII), and intellectual property processed by AI applications built on the platform. Microsoft's MSRC responded by deploying a hotfix that enforces stricter memory sanitization and isolation between inference calls at the hypervisor level, mitigating the issue for all customers.
Affected Systems
Testing Guide
Directly testing for this vulnerability is not feasible for customers as it requires exploiting a low-level infrastructure flaw. The primary method of verification is to: 1. **Check Azure Service Health:** Log in to the Azure Portal and navigate to the Service Health dashboard. 2. **Review Advisories:** Look for security advisories or platform update notifications related to 'AI Studio' or 'Machine Learning Endpoints' published in late May and early June 2026. 3. **Contact Support:** Open a support ticket with Microsoft Azure to request confirmation that the infrastructure hosting your specific AI Studio workspace and endpoints has received the cross-tenant memory isolation patch.
Mitigation Steps
1. **Confirm Patch Application:** For managed endpoints, Microsoft has applied a platform-wide patch. Confirm with Azure support or through service health notifications that your instances are running on the updated infrastructure. 2. **Rotate Credentials:** As a precautionary measure, rotate any API keys, tokens, or other secrets that were used in prompts sent to affected endpoints prior to the patch. 3. **Audit Logs:** Review access and inference logs for any anomalous activity, such as unusually formatted requests or unexpected error patterns, around the time of the disclosure. 4. **Consider Private Endpoints:** For applications handling extremely sensitive data, migrate from public managed endpoints to fully isolated solutions like Azure Machine Learning Private Endpoints to ensure network-level isolation.
Patch Details
Microsoft deployed a platform-wide, server-side hotfix in late May 2026. No user action is required for managed services as the patch was applied automatically.