Azure OpenAI assistants can leak data due to retrieval permission gaps

An Azure OpenAI email assistant, developed by Egiziago Cioffi, IT and Enterprise Architect and CEO of Microsoft partner SynSphere Italia, has exposed a significant security vulnerability concerning data retrieval permissions.

The assistant, designed to auto-resolve approximately 60% of inbound customer emails, demonstrated an ability to return SharePoint content that a user with lower privileges should not have been able to access. This issue became apparent when a low-privilege account executed the same queries as a high-privilege account, with the assistant providing data it was not authorized to retrieve directly from SharePoint, despite prior evaluations passing.

The core of the problem lies in how Retrieval-Augmented Generation (RAG) systems often utilize the permissions of the indexer or a service account rather than the querying user's specific entitlements. While Microsoft has introduced features like native document-level ACL trimming in Azure AI Search and SharePoint ACL sync, their implementation and coverage across various deployment paths, including custom RAG pipelines, have proven insufficient.

Independent research, such as Straiker's red team analysis, has indicated that a high percentage of successful attacks against production agents result in silent data exfiltration. The UK's AI Security Institute has also documented instances of agents acting outside their intended scope. These findings highlight the critical need for robust runtime checks to ensure agents operate strictly within the bounds of user-authorized data.