{
 "public_id": "AIR-2025-0011",
 "incident_id": "2025-02-microsoft-storm-2139",
 "date_disclosed": "2025-02-27",
 "date_occurred": "2024",
 "title": "Storm-2139: global network abusing scraped API credentials to resell jailbroken access to generative AI services",
 "class": "in_the_wild",
 "attack_surface": "agent_framework",
 "initial_vector": "scraped_public_credentials_and_custom_reverse_proxy",
 "agent_capability_abused": [
  "api_key_abuse",
  "guardrail_stripping",
  "access_resale"
 ],
 "target_product": "Azure OpenAI Service and other generative AI services",
 "target_vendor": "Microsoft",
 "autonomy_level": "assistant",
 "impact_realized": true,
 "impact_type": [
  "service_abuse",
  "credential_theft",
  "harmful_content_generation"
 ],
 "blast_radius": "Multiple customer accounts; a tiered creator/provider/user resale network",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI02",
   "ASI09"
  ],
  "mitre_atlas": [],
  "labels": [
   "llmjacking",
   "guardrail_bypass_as_a_service",
   "legal_action"
  ]
 },
 "defense_present": "Azure OpenAI content safeguards",
 "defense_bypassed": true,
 "fix_shipped": "Microsoft DCU lawsuit (E.D. Va.), court-ordered seizure of the group's website (Jan 2025) and amended complaint naming four defendants (Feb 2025)",
 "primary_sources": [
  "https://blogs.microsoft.com/on-the-issues/2025/02/27/disrupting-cybercrime-abusing-gen-ai/"
 ],
 "verified_quote": "exploited exposed customer credentials scraped from public sources to unlawfully access accounts with certain generative AI services",
 "confidence": "high",
 "notes": "Scope caveat: the downstream harm here was non-consensual intimate imagery, which the corpus otherwise excludes. Included because the mechanism - theft of AI service credentials, guardrail stripping and resale of access - is exactly the agent-infrastructure credential-theft economy this corpus tracks, and because it is one of very few cases with courtroom-grade evidence rather than vendor telemetry.",
 "risk_category": "safety_harm",
 "risk_secondary": [
  "security_fraud",
  "product_misuse"
 ],
 "risk_subcategory": "Non-consensual & Abusive Imagery",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "human_acted_on_output",
 "agency_debatable": true,
 "agency_reason": "humans used stolen keys and a reverse proxy to generate the harmful imagery",
 "vector_family": "other",
 "vector_detail": "scraped_public_credentials_and_custom_reverse_proxy",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI02",
 "agent_framework": "unknown",
 "model_provider": "multiple",
 "model_name": "",
 "detection_mechanism": "vendor_disclosure",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "bias_and_toxicity",
 "eai_domain": "agent_output_quality",
 "eai_secondary": [
  "credential_theft"
 ],
 "eai_reason": "subcategory: Non-consensual & Abusive Imagery",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI02 (impact=tool_misuse); ASI09 (eai_category=bias_and_toxicity)",
 "submitted_by": "EAI Internal"
}