Most authentication bypass writeups involve some cleverness in the exploit. This one is almost entirely about a service that never checked its own tokens. Titan is an internal Microsoft analytics layer sitting in front of several ClickHouse databases used for employee records, application telemetry and product usage data. Its public-facing entry point returned a page reading "VPN required" - the kind of response most people would read as a dead end. Faav's AI hacking assistant, a tool the researcher built and named Antares, treated it as a data point instead, and kept looking for an API path that didn't check for the VPN at all. It found one, hosted through Azure, according to the researcher's own account published at blog.faav.net.
Ten days of automated probing, then one manual guess
Antares spent from 25 August onward systematically throwing malformed and edge-case JSON Web Tokens at Titan's query endpoint, looking for a validation error it could pry open. That's the part an AI assistant is genuinely good at: patient, repetitive testing across a token format with dozens of fields worth trying. It didn't find the bug. The researcher did, by hand, at one in the morning on 5 September, after noticing the backend was reading the token's "upn" claim as a bare username rather than requiring the email-shaped identity the format normally implies. Set the algorithm header to "none" - a long-known and specifically-flagged-against JWT footgun - drop "admin" into that field, and the endpoint accepted the token as a legitimate administrator session. No password, no valid signature, no Microsoft credential of any kind involved. Coverage from Cybersecurity News and GBHackers both confirm the same root cause: an endpoint that decoded a token's claims without ever verifying the signature that was supposed to make those claims trustworthy.
17.3 trillion is a real number attached to an unreal scenario
That figure has done most of the work in circulating this story, and Faav has been unusually direct about what it does and doesn't mean. It's described in the researcher's own writeup as an estimate of rows theoretically reachable across Titan's connected databases - not 17.3 trillion customer records, not 17.3 trillion people, and not data the researcher actually pulled. iTnews's reporting notes the figure likely includes historical snapshots, replicated tables and derived datasets counted more than once, and the researcher was explicit that no customer PII was accessed - only metadata, table descriptions and small samples used to confirm the access actually worked. That distinction matters, and it's the first thing likely to get flattened as this story gets repeated: a real authentication failure, on a real Microsoft system, with an unverifiably large but genuinely hypothetical blast radius.
Four days from report to lockdown is the actual good news here
Faav opened MSRC case 144051 the same day the bug was confirmed. Microsoft locked the endpoint down within four days, and paid out the $5,000 bounty on 17 September before coordinating public disclosure for 25 September. Whatever else is debatable about the headline number, that response timeline is fast for an internal system this obscure - Titan isn't a customer-facing product with an existing incident playbook, it's the kind of analytics plumbing that normally takes longer to even locate the right owning team for.
- Treat "requires VPN" or network-location gating as a UX message, not a security control - verify every backend API independently enforces signature validation regardless of how a request reached it.
- Audit JWT validation logic specifically for the "alg: none" and unsigned-token classes of bug - these have been documented failure modes for over a decade and still recur in internal tooling that gets less scrutiny than customer-facing services.
- Don't let a token's claim format assumptions go unchecked - a backend that silently accepts a bare username where it expected a structured identity is a second, independent bug worth fixing on its own.
- Read impact estimates in vulnerability disclosures for what they measure - a count of theoretically reachable rows is not a count of records actually exposed, and researchers who are careful enough to say so deserve to have that caveat repeated alongside the number.
An internal analytics service most Microsoft customers had never heard of turned out to be one unverified claim away from full read access. It took an AI assistant ten days of grinding to find the door, and a teenager's judgment to notice which handle actually opened it. Email sales@halfteck.com if you'd like your own internal-only services checked against the same class of assumption.