Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
- AIDEFEND SecureFlow — Storm-2139 Azure OpenAI Guardrail Bypass
- MITRE ATLAS case study AML.CS0057
- Taking legal action to protect the public from abusive AI-generated content (blogs.microsoft.com)
- Disrupting a global cybercrime network abusing generative AI (blogs.microsoft.com)
- How Microsoft is taking down AI hackers who create harmful images of celebrities and others (news.microsoft.com)
Storm-2139 built custom jailbreak tooling to bypass guardrails on Azure OpenAI Services, allowing users to generate harmful synthetic content.
Microsoft reported that members of Storm-2139 scraped exposed customer credentials from public sources and used them to access accounts for generative AI services. The group developed and operated tools and services that bypassed safety safeguards, modified service capabilities, and enabled end users to generate harmful and illicit content, including non-consensual intimate images of celebrities and other sexually explicit content.
The operation included creators who developed illicit tools, providers who modified and supplied those tools, and users who generated prohibited content. Microsoft pursued civil legal action.
ASSESSED SYSTEM
Representative configuration: an Azure OpenAI Service customer resource as it stood during the Storm-2139 operation Microsoft disclosed in January 2025, accessible with customer credentials that had been exposed in public sources, offering synthetic image generation, and protected by the service's safeguards and content filters. Scored as the configuration stood when the scraped credentials were used and the filters were bypassed.
OUT OF SCOPE
The de3u jailbreak frontend and the Storm-2139 reverse proxy service, which are attacker tooling and infrastructure; the network's creators, providers, and end users; the public sources from which credentials were scraped; and the downstream harm to depicted individuals once outputs left the boundary. The state of Azure OpenAI Service after Microsoft's disruption and legal action is not described by the record and is not assessed.
Architecture: Standalone LLM / Generative AI (decision tree Q5) — Q1 to Q4 = NO: the assessed boundary is a hosted generative service invoked with customer credentials; no agent coordination, autonomous planning, tool execution, or retrieval is described. Q5 = YES: the service generated prompt-driven synthetic imagery returned directly to the caller, which is the surface Storm-2139 abused. Tier 2: Tier 2 Consumer: a public cloud generative service reachable from the internet, and the realised harm, non-consensual intimate imagery and other abusive content depicting real people, lands directly on identifiable individuals rather than causing physical or critical-infrastructure harm at scale.
Documented attack or failure path
- Tool and infrastructure staging. Storm-2139 developed the de3u jailbreak tool, acquired infrastructure, and operated a reverse proxy so other users could reach the abused generative AI services.
- Credential misuse. The group used exposed customer credentials scraped from public sources to access valid Azure OpenAI Service accounts, with de3u as the frontend.
- Guardrail evasion. The actors iterated on blocked prompts, substituted celebrity descriptions, and used altered wording or technical notation to evade content filters.
- Harmful generation. End users generated non-consensual intimate images of celebrities and other sexually explicit, misogynistic, violent, or hateful imagery.
- Impact. The imagery could directly harm depicted individuals, and customers whose accounts were stolen were harmed financially. Microsoft pursued civil legal action.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- The service's content filters blocked prompts during the operation; Microsoft reports that the actors had to iterate on blocked prompts before obtaining prohibited outputs.
- Microsoft identified the network and its creator, provider, and user roles, and pursued civil legal action against it.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.07–0.79 (midpoint 0.43), Tier 2 MVT 0.50 indeterminate | |||
| Ro-1Adversarial Input Resistance | 0.25w 0.28 | The 0.25 anchor: basic defences resisted naive prohibited prompts but failed under moderate, iterative perturbation reliable enough to resell. No attack success rate is published; the 0.50 anchor requires resistance to common adversarial rewording, which is the technique that succeeded. | Prohibited prompts were initially blocked, then succeeded after the actors iterated wording, substituted celebrity descriptions, and used technical notation, and the bypass was operated as a repeatable service through the de3u frontend.source: secureflow/atlas |
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Containment (Cn) — scenario interval 0.07–0.80 (midpoint 0.43), Tier 2 MVT 0.55 indeterminate | |||
| Cn-3Output Filtering Robustness | 0.25w 0.18 | The 0.25 anchor, matched literally: filters exist but are bypassed by paraphrase and encoding-style rewording. The 0.50 anchor requires filtering that blocks common unsafe outputs; prohibited sexual imagery of real people escaped repeatedly. | Content filters existed and blocked requests, yet prohibited synthetic imagery, including non-consensual intimate images of celebrities, was returned after paraphrase, description substitution, and notation changes.source: secureflow/atlas |
| Cn-5Agent Identity Integrity | 0.25w 0.09 | The 0.25 anchor: credential authentication existed (access depended on obtaining valid customer credentials, above 0.00), but a leaked credential was sufficient on its own, with no binding to the legitimate customer's workload or origin to stop replay and resale. The 0.50 anchor requires scoped token identity with partial verification, which is not evidenced. | Customer credentials scraped from public sources authenticated the actors to valid Azure OpenAI Service accounts, and the reverse proxy extended that access to the network's end users, whose prompts ran under the victims' identities.source: secureflow/atlas |
Unknown, not N/A: 22 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Architecture-based NOT APPLICABLE: declared with an architecture rationale in the workpaper: Cn-9.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.25w 0.25 | The assessed service generates output and holds no tool, write, or transaction authority on the observed path. Placed at 0.25 rather than 0.00 because responses flowed to automated consumers with no human review, which the 0.00 anchor ('every output reviewed') does not describe. |
| AsAttack Surface Exposure | 0.75w 0.35 | Above the 0.50 anchor even though content filtering was present: that placement presumes the authenticated boundary holds, but stolen customer credentials and a public reverse proxy let arbitrary third parties submit adversarial prompts to the service. Not 1.00: no untrusted retrieval, multi-agent, or MCP integration lies inside the boundary. |
| CpCascade Potential | 1.00w 0.20 | No verified System Dependency Graph with DGC at least 0.90 is public for this boundary, so the specification's worst-case graph default governs rather than an assessor-estimated blast radius.GDCP: worst-case default — no verified dependency graph published elevated |
| RfRemediation Feasibility | 0.75w 0.20 | Two remediation classes, and the harder governs. Rotating exposed keys is deterministic, but paraphrase evasion of content filters is a property of the model-and-filter stack that guardrail updates reduce without eliminating, which is the 0.75 anchor. Scored exactly at 0.75 and therefore not counted as elevated. |
Nelevated = 1 (dimensions strictly above 0.75) → CRM = 1.00.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | The service and its owner are identified, but the affected customer resources, their configuration, and the filter versions in force are not; no asset manifest, dependency graph, or assessment evidence manifest is public. |
| Ec — Public evaluation coverage | 0.08 | coverage 0.12 (3 of 25 applicable sub-metrics) × independence 0.80 × fidelity 0.85. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.01 | Evidence dated 2025-01-10; age 646 days on the workpaper reference date. Components: T_calendar 0.01 · C_event 0.35 · C_monitor 0.85 · C_evidence 0.85. Binding term: T_calendar. dt_days = 646, measured from originating evidence to the 2026-10-18 evidence reference date. MITRE ATLAS AML.CS0057 records the incident at month granularity (2024-12), which marks the activity window rather than a dated public disclosure. agentic = false and baw = false: hosted generation with no tool, memory, or feedback loop inside the boundary. C_monitor 0.85: provider investigation identified the network and its roles, but only after prohibited content had been generated. C_event 0.35: confirmed guardrail bypass producing prohibited content through stolen customer credentials. C_evidence 0.85: the post-disruption filter and credential state is not described. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.05 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
4.0 midpoint, interval 1.4–6.6; Low-Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS
CVSS — no applicable published score verified.
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-E-001.001 | Root & Long-Lived Credential Object EvictionExact SecureFlow defense-map identifier (flow atlas-aml-cs0057-storm-2139-azure-openai-guardrail-bypass), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Cn-5 |
| AID-E-001.002 | Issued Token, Authentication Session & Lease RevocationExact SecureFlow defense-map identifier (flow atlas-aml-cs0057-storm-2139-azure-openai-guardrail-bypass), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Cn-5 |
| AID-I-003.003 | Resource, Token & Spend Budget ThrottlingExact SecureFlow defense-map identifier (flow atlas-aml-cs0057-storm-2139-azure-openai-guardrail-bypass), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-6 Cn-7 |
| AID-D-001.001 | Per-Prompt Content, Intent & Obfuscation AnalysisExact SecureFlow defense-map identifier (flow atlas-aml-cs0057-storm-2139-azure-openai-guardrail-bypass), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-1 |
| AID-H-002.002 | Inference-Time Prompt & Input ValidationExact SecureFlow defense-map identifier (flow atlas-aml-cs0057-storm-2139-azure-openai-guardrail-bypass), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-1 Ro-5 Fa-1 Fa-3 Cn-8 |
| AID-D-001.006 | Prompt Gate Decision Telemetry CorrelationExact SecureFlow defense-map identifier (flow atlas-aml-cs0057-storm-2139-azure-openai-guardrail-bypass), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-1 |
| AID-I-003.002 | Identity, Session & API Rate-Limit ThrottlingExact SecureFlow defense-map identifier (flow atlas-aml-cs0057-storm-2139-azure-openai-guardrail-bypass), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-6 Cn-7 |
| AID-D-003.008 | Generated Media & Binary Output Policy-Violation DetectionExact SecureFlow defense-map identifier (flow atlas-aml-cs0057-storm-2139-azure-openai-guardrail-bypass), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-7. Presence supplies no score credit. | Candidate evidence route | Ro-3 Cn-1 Cn-3 Cn-7 |
| AID-H-013.001 | Digital Content Watermarking & Signed ProvenanceExact SecureFlow defense-map identifier (flow atlas-aml-cs0057-storm-2139-azure-openai-guardrail-bypass), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-7. Presence supplies no score credit. | Candidate evidence route | Ro-4 Pr-1 |
| AID-D-001.002 | Synthetic Media & Deepfake ForensicsExact SecureFlow defense-map identifier (flow atlas-aml-cs0057-storm-2139-azure-openai-guardrail-bypass), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-8. Presence supplies no score credit. | Candidate evidence route | Ro-1 |
WHAT THIS CASE TEACHES
A content filter that blocks the first attempt but yields to iterative rewording is a 0.25 control, and on a hosted service it fails together with credential binding: Storm-2139 needed both a leaked key and paraphrase evasion, so AITBM records Ro-1, Cn-3, and Cn-5 at the same low anchor while Rf sits at the guardrail-only ceiling.
Sources: AIDEFEND SecureFlow — Storm-2139 Azure OpenAI Guardrail Bypass · MITRE ATLAS case study AML.CS0057 · Taking legal action to protect the public from abusive AI-generated content (blogs.microsoft.com) · Disrupting a global cybercrime network abusing generative AI (blogs.microsoft.com) · How Microsoft is taking down AI hackers who create harmful images of celebrities and others (news.microsoft.com)
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The scenario above places only the control outcomes this flow and its primary references observed; the matched AIDEFEND controls are evidence routes and earn no score credit.
| MITRE ATLAS case study | AML.CS0057 (incident) |
|---|---|
| Target | Microsoft Azure OpenAI Service |
| Actor | Storm-2139 |
| Reporter | Microsoft |
| Primary evidence date | 2024-12-01 |
| SecureFlow record updated | 2026-08-06 |
| AI layers | AI infrastructure |
| Risk impact | Resource hijacking / cost, Model evasion / bypass, Credential and identity theft |
| Affected components | Azure OpenAI Service customer credentials, de3u jailbreak frontend, Storm-2139 reverse proxy service, content safety and guardrail pipeline, synthetic image generation workflow |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Develop de3u Jailbreak ToolStorm-2139 creators developed a tool called de3u to facilitate unauthorized use of generative AI services and bypass safeguards. | AML.TA0003 AML.T0017 |
| 2 | Acquire Jailbroken Service InfrastructureStorm-2139 acquired infrastructure to support a service that sold access to the jailbroken Azure OpenAI Service. | AML.TA0003 AML.T0008 |
| 3 | Operate Reverse Proxy Access ServiceStorm-2139 staged and operated a reverse proxy service to allow other malicious users to interact with abused generative AI services. | AML.TA0003 AML.T0079 |
| 4 | Use Exposed Customer CredentialsStorm-2139 used exposed customer credentials scraped from public sources to access valid accounts for generative AI services. | AML.TA0004 AML.T0012 |
| 5 | Access Azure OpenAI via de3u FrontendThe stolen credentials provided access Azure OpenAI Service, allowing the actors and their customers to submit prompts and generate content. Storm-2139's de3u tool was used as the frontend for this access. | AML.TA0000 AML.T0040 |
| 6 | Iterate Prompts to Bypass SafeguardsStorm-2139 deliberately bypassed Azure OpenAI Service safeguards and content filters to generate prohibited outputs. Microsoft reported that the actors iterated on blocked prompts, substituted celebrity descriptions, and used altered wording or technical notation to evade filters. | AML.TA0007 AML.T0054 |
| 7 | Generate Abusive Synthetic ImageryEnd users generated abusive synthetic imagery, including non-consensual intimate images of celebrities and other sexually explicit, misogynistic, violent, or hateful content. | AML.TA0001 AML.T0088 |
| 8 | Harm Depicted IndividualsThe generated abusive imagery could cause direct harm to depicted individuals. | AML.TA0011 AML.T0048.002 |
| 9 | Create Stolen-Account Financial HarmUsers whose accounts were stolen were harmed financially. | AML.TA0011 AML.T0048.000 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0057-storm-2139-azure-openai-guardrail-bypass; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0057 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).