Microsoft Sues Over AI Misuse in Azure Hacking Scheme

TechCrunch reports that Microsoft has filed a lawsuit against ten unnamed defendants for allegedly bypassing the safety guardrails of its Azure OpenAI Service. The complaint, Microsoft Corporation v. Does 1-10 Operating an Azure AbuseNetwork, accuses the defendants of using stolen customer credentials and custom software to generate harmful content, violating Microsoft’s policies.

Legal claims include Computer Fraud and Abuse Act violations, the Digital Millennium Copyright Act, and federal racketeering laws. Microsoft is seeking injunctive relief and damages.

In July 2024, Microsoft discovered that stolen Azure OpenAI Service API keys were used to generate inappropriate content. The API keys, essential for authenticating users or apps, were stolen from paying US-based customers. Azure is widely used by corporate executives. 

Microsoft alleges the defendants engaged in systematic API key theft to develop a “hacking-as-a-service” operation. The group reportedly created a client-side tool, de3u, and additional software to facilitate communication with Microsoft’s systems.

According to the complaint, the defendants used their unauthorized access to create offensive and harmful content, violating the company’s acceptable use policies. The stolen credentials were allegedly exploited to operate a broader hacking scheme.

While the precise theft methods remain unclear, Microsoft emphasizes the systematic and targeted nature of the misconduct.

This case highlights the legal challenges surrounding AI misuse, including safeguarding intellectual property and enforcing acceptable use policies. Proactive measures, such as monitoring API key security and responding to breaches, are required. In the event of IP and/or data theft, litigation should be prompt and forceful.