Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
- AIDEFEND SecureFlow — ClearviewAI Misconfiguration
- MITRE ATLAS case study AML.CS0006
- TechCrunch Article, "Security lapse exposed Clearview AI source code" (techcrunch.com)
- Gizmodo Article, "We Found Clearview AI's Shady Face Recognition App" (gizmodo.com)
- New York Times Article, "The Secretive Company That Might End Privacy as We Know It" (nytimes.com)
Clearview AI makes a facial recognition tool that searches publicly available photos for matches. This tool has been used for investigative purposes by law enforcement agencies and other parties.
Clearview AI's source code repository, though password protected, was misconfigured to allow an arbitrary user to register an account. This allowed an external researcher to gain access to a private code repository that contained Clearview AI production credentials, keys to cloud storage buckets containing 70K video samples, and copies of its applications and Slack tokens. With access to training data, a bad actor has the ability to cause an arbitrary misclassification in the deployed model.
These kinds of attacks illustrate that any attempt to secure ML system should be on top of "traditional" good cybersecurity hygiene such as locking down the system with least privileges, multi-factor authentication and monitoring and auditing.
ASSESSED SYSTEM
Clearview AI's facial recognition tool together with its development and release environment as exposed in April 2020: the private source-code repository, which was password protected but misconfigured to let an arbitrary user register an account; the production credentials, cloud-storage keys, and Slack access tokens stored in it; and the AWS S3 buckets those keys opened, holding released and pre-release desktop and mobile application builds and raw videos and other data, including about 70,000 video samples.
OUT OF SCOPE
The face-matching accuracy of the model, its photo-collection practices, and the privacy and legal questions raised about them; any modification of training data or application releases, which the record describes only as possible; the researcher's own access and tooling; Slack and other third-party services reached by the exposed tokens; and the environment as changed after disclosure.
Architecture: Traditional ML / Classifier (decision tree Q6) — The decision tree resolves at Q6 by elimination. Q1 = NO and Q2 = NO: no agents, planner, or autonomous workflow. Q3 = NO: the model calls no functions or connectors. Q4 = NO on the evidenced boundary: the tool searches publicly available photos for matches, but the record documents no retrieval layer supplying context to a model at inference time, and the evidenced failure lies in the build-and-release environment; gallery search is treated as part of the face-matching function. Q5 = NO: no generative interface. What remains is a bounded face-matching product with its supporting repository and storage, the Q6 class. Tier 2: Tier 2: the tool's identification results are used by law-enforcement agencies and other parties for investigative purposes, so exploitation — including the model-integrity compromise the record describes as possible — would affect identified individuals. The record shows identification informing investigations rather than executing consequential decisions directly, which keeps it below Tier 1.
Documented attack or failure path
- A security researcher gained access to Clearview AI's password-protected private source-code repository by registering a valid account, because a misconfigured server setting allowed an arbitrary user to register.
- The repository contained production credentials, including keys to AWS S3 cloud-storage buckets, and Slack access tokens.
- The credentials opened buckets holding released desktop and mobile applications, pre-release applications featuring new capabilities, and raw videos and other data, including about 70,000 video samples.
- The record states that an adversary could have downloaded training data, gleaned model and capability details from the source code and decompiled binaries, and compromised future application releases; none of these is reported as having occurred.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- Repository authentication was in place: access required a registered account and password, and the failure was the registration setting that let anyone obtain an account rather than an absence of authentication. This is why Cn-2 is placed at 0.25 rather than 0.00.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Containment (Cn) — scenario interval 0.08–0.76 (midpoint 0.42), Tier 2 MVT 0.55 indeterminate | |||
| Cn-2Escalation Prevention | 0.25w 0.23 | The 0.25 anchor: basic role checks existed (the repository was password protected and required an account) but were defeated by a misconfiguration, and the credentials stored in the repository then conveyed production authority to anyone who could read it, so credential misuse escalated an outside user to production storage access. The 0.50 anchor requires privilege boundaries that block common escalation paths; reading secrets from source control is a common path and was not blocked. Not 0.00, because an authentication boundary existed and had to be circumvented. | An arbitrary self-registered repository account reached production credentials and cloud-storage keys stored in source control, and those keys opened S3 buckets holding application builds, pre-release applications, and raw video data, a path from an unprivileged outside principal to production storage authority with no further authorisation step.source: secureflow/atlas |
| Cn-5Agent Identity Integrity | 0.25w 0.08 | The 0.25 anchor: basic API-key or shared-secret authentication protected the storage and messaging integrations, but production secrets were stored in source control, nothing bound them to a workload, and their use by an outside party was not detected. The 0.50 anchor requires token-based identity with scoped permissions and partial verification; the record shows no scoping or binding of the keys. Not 0.00, because a credential was required and unauthenticated calls to the buckets are not described. | Workload access to production cloud storage and Slack relied on static credentials and tokens committed to the source repository; possession of the copied secrets was sufficient to open the S3 buckets, with no binding of the credential to the workload, host, or session that legitimately used it.source: secureflow/atlas |
Unknown, not N/A: 21 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Architecture-based NOT APPLICABLE: declared with an architecture rationale in the workpaper: Cn-6; NOT APPLICABLE by design for this architecture class: Cn-8, Cn-9.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.25w 0.25 | The tool returns facial search matches for investigative use; no autonomous action authority is evidenced. Scored at 0.25 rather than 0.00 because review of every output before action is not documented, and well below 0.50 because the tool executes nothing on its own. |
| AsAttack Surface Exposure | 1.00w 0.35 | The 1.00 anchor on the evidenced exposure: the management plane — the source repository holding production credentials — accepted self-registration from any internet user, so untrusted principals reached the assessed environment with no effective authentication, the same treatment the corpus gives unauthenticated management interfaces. The data plane additionally ingests publicly available photos collected from the web. elevated |
| CpCascade Potential | 1.00w 0.20 | No verified System Dependency Graph with DGC at least 0.90 is public, so the specification's worst-case default applies. It is corroborated by the observed path: an outside principal with a self-registered account reached production credentials (credential-issuing material) and through them storage holding application builds and video data, with no gate after the repository login.GDCP: corroborated by the observed path elevated |
| RfRemediation Feasibility | 0.25w 0.20 | Model-adjacent anchor: closing the path requires disabling open registration, removing secrets from source control, rotating the exposed production credentials, cloud keys, and Slack tokens, and re-scoping storage permissions — deployment-infrastructure work measured in days that does not touch the model. Not 0.00, because rotation and permission re-scoping across several services go beyond a single configuration change; re-validation of training data and releases would be needed only if tampering were found, which the record does not report. |
Nelevated = 2 (dimensions strictly above 0.75) → CRM = 1.15.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | At the 0.25 anchor. The vendor and product (Clearview AI's facial recognition tool) are named and the exposed components — repository, S3 buckets, application builds, video samples, Slack tokens — are enumerated; no model identity, configuration export, AIBOM, or evaluation artefact is public. |
| Ec — Public evaluation coverage | 0.07 | coverage 0.09 (2 of 23 applicable sub-metrics) × independence 1.00 × fidelity 0.85. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.00 | Evidence dated 2020-04-16; age 2376 days on the workpaper reference date. Components: T_calendar 0.00 · C_monitor 0.65 · C_event 0.65 · C_evidence 0.85. Binding term: T_calendar. Evidence age is measured from the 2020-04-16 public disclosure (the TechCrunch report, matching the MITRE ATLAS incident date) to the 2026-10-18 evidence reference date, 2349 days, so the calendar term dominates. agentic = false and baw = false: no runtime tool reprovisioning, model-writable memory, online learning, or self-modifying configuration is described; the exposed static credentials are scored in Cn-5, not through a containment staleness floor. C_monitor 0.65: the exposure was found by an external researcher, and no internal detection of the self-registered account or of credential use is evidenced. C_event 0.65: the moderate row is applied for an exploited misconfiguration; no model or release change event is documented. C_evidence 0.85: the record documents no remediation. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.00 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
4.4 midpoint, interval 1.3–7.6; Low-Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS
CVSS — no applicable published score verified.
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-M-005.002 | Policy-as-Code Configuration Baselines & Posture Release GatesExact SecureFlow defense-map identifier (flow atlas-aml-cs0006-clearviewai-misconfiguration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-1. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-9 |
| AID-H-004.001 | User & Privileged Access ManagementExact SecureFlow defense-map identifier (flow atlas-aml-cs0006-clearviewai-misconfiguration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-1. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-5 |
| AID-D-005.003 | Proactive AI Threat HuntingExact SecureFlow defense-map identifier (flow atlas-aml-cs0006-clearviewai-misconfiguration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-1, step-2. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-7 |
| AID-E-001.001 | Root & Long-Lived Credential Object EvictionExact SecureFlow defense-map identifier (flow atlas-aml-cs0006-clearviewai-misconfiguration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-2. Presence supplies no score credit. | Candidate evidence route | Cn-5 |
| AID-E-001.002 | Issued Token, Authentication Session & Lease RevocationExact SecureFlow defense-map identifier (flow atlas-aml-cs0006-clearviewai-misconfiguration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-2. Presence supplies no score credit. | Candidate evidence route | Cn-5 |
| AID-I-002.001 | Internal AI Network SegmentationExact SecureFlow defense-map identifier (flow atlas-aml-cs0006-clearviewai-misconfiguration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-2. Presence supplies no score credit. | Candidate evidence route | Cn-4 |
| AID-H-003.002 | CI/CD Release Gating, Model Artifact Signing & Secure DistributionExact SecureFlow defense-map identifier (flow atlas-aml-cs0006-clearviewai-misconfiguration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Ro-4 Ro-5 Tr-4 |
| AID-H-007.004 | Evaluation Data Integrity, Sufficiency Assurance & Promotion GovernanceExact SecureFlow defense-map identifier (flow atlas-aml-cs0006-clearviewai-misconfiguration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Ro-4 |
| AID-D-004.001 | Static Artifact Integrity Re-verification & Drift MonitoringExact SecureFlow defense-map identifier (flow atlas-aml-cs0006-clearviewai-misconfiguration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Ro-5 Tr-3 Cn-7 Cn-9 |
| AID-R-001.001 | Versioned Model Rollback & RestorationExact SecureFlow defense-map identifier (flow atlas-aml-cs0006-clearviewai-misconfiguration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Ro-4 |
WHAT THIS CASE TEACHES
An AI supply-chain exposure with no model-level attack is scored on the escalation and workload-identity controls that failed (Cn-2 and Cn-5 at 0.25), while the training-data and release tampering the record calls possible stays UNKNOWN, so Ro-4 and Tr-4 are not inferred from a hypothetical.
Sources: AIDEFEND SecureFlow — ClearviewAI Misconfiguration · MITRE ATLAS case study AML.CS0006 · TechCrunch Article, "Security lapse exposed Clearview AI source code" (techcrunch.com) · Gizmodo Article, "We Found Clearview AI's Shady Face Recognition App" (gizmodo.com) · New York Times Article, "The Secretive Company That Might End Privacy as We Know It" (nytimes.com)
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The scenario above places only the control outcomes this flow and its primary references observed; the matched AIDEFEND controls are evidence routes and earn no score credit.
| MITRE ATLAS case study | AML.CS0006 (incident) |
|---|---|
| Target | Clearview AI facial recognition tool |
| Actor | Researchers at spiderSilk |
| Primary evidence date | 2020-04-16 |
| SecureFlow record updated | 2026-08-06 |
| AI layers | AI supply chain, Predictive ML / computer vision |
| Risk impact | Credential and identity theft |
| Affected components | AI source code repository, cloud storage buckets (training data and models), facial recognition model releases, production credentials and access tokens |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Register Account via Misconfigured RepositoryA security researcher gained initial access to Clearview AI's private code repository via a misconfigured server setting that allowed an arbitrary user to register a valid account. | AML.TA0003 AML.T0021 |
| 2 | Collect Artifacts from Information RepositoriesThe private code repository contained credentials which were used to access AWS S3 cloud storage buckets, leading to the discovery of assets for the facial recognition tool, including: - Released desktop and mobile applications - Pre-release applications featuring new capabilities - Slack access tokens - Raw videos and other data | AML.TA0009 AML.T0036 |
| 3 | Acquire Training Data and Model DetailsAdversaries could have downloaded training data and gleaned details about software, models, and capabilities from the source code and decompiled application binaries. | AML.TA0003 AML.T0002 |
| 4 | Erode Facial Recognition Model IntegrityAs a result, future application releases could have been compromised, causing degraded or malicious facial recognition capabilities. | AML.TA0011 AML.T0031 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0006-clearviewai-misconfiguration; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0006 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).