Cross-Tenant Log Data Exposure in Azure OpenAI Service via In-Band Telemetry Injection
Overview
A medium-severity information disclosure vulnerability was discovered in the Azure OpenAI Service's backend logging infrastructure. Researchers found that by submitting prompts containing specific sequences of malformed Unicode and control characters, they could interfere with the service's internal telemetry and logging system. This interference could cause small, fragmented portions of the user's prompt or the model's completion to be incorrectly parsed and misattributed, leading to them being written into the diagnostic log streams of a different, unrelated Azure tenant. The vulnerability did not allow an attacker to target a specific tenant or to read another tenant's logs directly. Instead, it created a risk of random, fragmented data leakage between active tenants. An attacker could repeatedly submit crafted prompts to increase the probability of their data being leaked or potentially causing another user's data to leak. While the leaked fragments were typically small and incomplete, they could still expose sensitive information like names, partial keys, or internal identifiers present in the prompts. Microsoft addressed the issue by deploying new sanitization and encoding rules in their logging pipeline to ensure strict separation and proper handling of user input within their internal telemetry systems.
Affected Systems
Testing Guide
This vulnerability was in the cloud provider's backend and has been patched. It is no longer possible for customers to test for or reproduce this issue. Verification of the patch would require access to Microsoft's internal infrastructure.
Mitigation Steps
1. **No User Action Required:** The vulnerability existed in the Azure backend infrastructure and was patched by Microsoft for all customers. No user-side configuration changes are needed. 2. **Review Historical Logs:** Organizations with high-security requirements may consider reviewing historical log data for any anomalous or out-of-place entries during the vulnerability window, although identification would be difficult. 3. **Data Minimization:** As a general best practice, avoid sending unnecessary personally identifiable information (PII) or other sensitive data in prompts to any cloud AI service. 4. **Enable Advanced Data Protection:** For eligible customers, enable advanced data protection features like Customer-Managed Keys to add another layer of data security.
Patch Details
Microsoft deployed a server-side patch to their logging and telemetry ingestion pipeline in December 2025. The issue was fully mitigated for all customers by January 2026.