In the wild
Realized harm
Storm-2139: global network abusing scraped API credentials to resell jailbroken access to generative AI services
AIR-2025-0011 AIR record · 2025-02-microsoft-storm-2139
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
exploited exposed customer credentials scraped from public sources to unlawfully access accounts with certain generative AI servicesblogs.microsoft.com
The record
Disclosed
2025-02-27
Occurred
2024
Vendor
Microsoft
Product
Azure OpenAI Service and other generative AI services
Risk domain
Agent output quality › Bias and toxicity
Also touches
Credential theft
System type
Generative model
Who acted
Human acted on output (contested) — humans used stolen keys and a reverse proxy to generate the harmful imagery
Attack surface
Agent framework
Autonomy level
Assistant
Initial vector
Scraped public credentials and custom reverse proxy
Impact type
Service abuse, Credential theft, Harmful content generation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI09 – Human-Agent Trust Exploitation
- MITRE ATLAS
- AML.T0048 – External Harms
- NIST AI RMF
- MEASURE 2.11
- EU AI Act
- Recital 45
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- F. Society
- Scope
- agent failure
- Mitigation
- Audit and curate training data for representation; Implement content filtering on inputs and outputs.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Multiple customer accounts; a tiered creator/provider/user resale network
Capability abused
Defense & remediation
Recorded defense
Azure OpenAI content safeguards
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Microsoft DCU lawsuit (E.D. Va.), court-ordered seizure of the group's website (Jan 2025) and amended complaint naming four defendants (Feb 2025)
Taxonomy & references
Curator notes
Scope caveat: the downstream harm here was non-consensual intimate imagery, which the corpus otherwise excludes. Included because the mechanism - theft of AI service credentials, guardrail stripping and resale of access - is exactly the agent-infrastructure credential-theft economy this corpus tracks, and because it is one of very few cases with courtroom-grade evidence rather than vendor telemetry.
Supporting sources
Cite as
Enkrypt AI. "Storm-2139: global network abusing scraped API credentials to resell jailbroken access to generative AI services". AIR, AIR-2025-0011. https://agentincident.vercel.app/i/AIR-2025-0011/ (accessed 2026-10-19).