Microsoft has fixed a critical vulnerability in Azure Cosmos DB that could have allowed an attacker to locate and take control of databases belonging to any customer. Wiz Research named the flaw CosmosEscape and said it also placed databases used internally by Microsoft services within reach.

The vulnerability was found in the Gremlin API, an interface used to work with graph databases, where information is stored as connected items and relationships. A malicious user needed an Azure Cosmos DB account of their own, but did not need access to the organization they intended to target.

According to Wiz’s findings shared with Hackread.com, a specially prepared Gremlin query could break out of the restricted environment processing it and run commands on Microsoft’s backend systems. From there, the researchers obtained a platform secret they named the “Cosmos Master Key.”

Master Key Opened Two Paths to Customer Data

Possession of that secret provided two separate capabilities. The first allowed the holder to request the primary key for any Cosmos DB account, giving full permission to read and change data stored in that account.

The second allowed databases hosted by the service to be listed and searched using identifiers such as an Azure tenant ID or subscription ID. An attacker could therefore identify databases belonging to a chosen company and then retrieve the keys needed to access them.

Wiz said the method worked regardless of the database’s region or supported API type and included private databases. Wiz tested the exploit through publicly accessible service endpoints, without compromising the target’s Azure account first.

Microsoft Services Also Use Cosmos DB

Cosmos DB supports applications that need fast access to data in multiple geographic regions. Microsoft also uses it behind services including Entra ID, Teams and Copilot, meaning databases associated with those products could have been identified and accessed through the same weakness, according to Wiz.

This does not mean customer or Microsoft databases were breached. Wiz described the result of controlled security research, while Microsoft told Reuters that the problem had been fully addressed and that its investigation found no evidence of customer impact.

The flaw affected the service itself, so customers could not have fixed it by changing their own application code or Azure settings. The central role of the master key also meant one successful attack could have crossed the normal separation between different customers and Microsoft’s internal services.

“This discovery underscores the value of cloud security research, particularly as the rise of AI is accelerating the pace and sophistication of vulnerability discovery, making attack surface management more critical than ever,” said Robert Costello, Chief Digital and Information Officer at Merlin Group.

“Wiz identified and responsibly disclosed a high-impact vulnerability, allowing time to remediate before it could be broadly exploited. The complexity of this flaw, and its potential to expose every Cosmos DB instance, is a reminder that even the largest cloud providers must constantly test their own environments. This demonstrates why continuous cloud posture visibility and close vendor collaboration are essential to protecting modern cloud environments,“ Robert emphasized.

Microsoft Removes the Cosmos Master Key

After receiving the report, Microsoft removed the platform-wide Cosmos Master Key and introduced additional controls intended to stop similar access from the Gremlin processing environment. Microsoft handled the remediation within its managed Azure infrastructure.

The company’s removal of the shared secret addresses more than the specific query used by Wiz. It also removes the mechanism that allowed one backend credential to retrieve account keys and search database information throughout the service.

CosmosEscape follows Wiz’s 2021 disclosure of ChaosDB, a separate Cosmos DB vulnerability involving the service’s Jupyter Notebook feature. That earlier flaw could also have exposed customer database keys, although the two findings used different entry points.

Nevertheless, organizations using Cosmos DB should still review account activity, key access, and unexpected database operations as part of normal monitoring. Microsoft’s statement that it found no customer impact means there is currently no evidence that attackers used CosmosEscape outside Wiz’s testing.

Waqas

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cybersecurity and tech world. I am also into gaming, reading and investigative journalism.

View Posts

Melbourne, Florida, July 30th, 2026, CyberNewswire

The growing number of high-profile AI security incidents making headlines around the world are not simply cybersecurity failures. They are architectural failures, according to OpenMatter Network Co-Founder and CEO Renee Davis.

“Recent incidents involving increasingly autonomous AI systems – including OpenAI’s widely reported cyber evaluation that resulted in the compromise of Hugging Face infrastructure, along with a growing body of documented cases in which AI systems have exceeded their intended authority or behaved in unexpected ways – demonstrate that enterprise computing has entered a new era for which today’s security architecture was never designed,” Davis said.

Davis said that instead of asking how to make artificial intelligence more secure, enterprise leaders should be asking a far more fundamental question: Is the architecture itself capable of governing autonomous intelligence?

“The answer is increasingly becoming no,” she asserted. “The industry is treating these events as isolated security incidents. They’re not. They’re evidence that enterprise computing has reached an architectural inflection point. We’re attempting to govern autonomous AI using security assumptions that were developed long before autonomous AI existed.”

For more than forty years, enterprise security has evolved around a familiar model: trusted systems, authenticated users and protected networks. Firewalls, identity management, Zero Trust frameworks and continuous monitoring remain indispensable. But they were built to protect systems that ultimately remained under direct human control.

Agentic AI fundamentally changes that assumption. Enterprises are now deploying software capable of making decisions, coordinating with other AI agents, accessing sensitive information and acting with limited human intervention. Autonomous intelligence has become an active participant inside the enterprise.

Davis underscored that OpenMatter believes the next era of enterprise computing requires a new architectural foundation: Verification Architecture. Rather than relying primarily on trust, Verification Architecture uses cryptographic proof to verify the integrity of data, computation and AI behavior. Instead of asking enterprises to trust that systems behaved correctly, it enables them to prove that they did.

“Trust always contains an element of assumption,” Davis emphasized. “Cryptographic verification replaces assumption with mathematical proof. That is the architectural shift enterprise computing now requires.”

According to Davis, every transformational era of computing has required a corresponding architectural breakthrough. The internet required encryption. Cloud computing required virtualization. Autonomous AI requires cryptographic verification.

“Every major AI security incident should now be viewed first as an architectural failure and only second as a cybersecurity event,” Davis said. “The next major AI incident is not simply a security event. It will be an architectural wake-up call.”

OpenMatter is calling on enterprise technology leaders, policymakers, standards organizations and the cybersecurity community to begin treating cryptographic verification not as another security feature, but as the architectural foundation upon which trustworthy autonomous computing must be built.

“Enterprise computing has reached another architectural crossroads,” Davis concluded. “The era of trusting autonomous AI is coming to an end. The era of proving autonomous AI has begun. The organizations that recognize that shift first will define the next generation of enterprise computing.”

For more information, contact onboarding@openmatter.network.

About OpenMatter Network

Headquartered in Florida’s Space Coast, OpenMatter Network is building the Verifiable Trust Layer for Secure Collaboration and AI Agents. Guided by the principle “Don’t Trust Data. Prove It.,” the company’s cryptographically verifiable architecture enables secure collaboration, governed AI behavior and mathematically verifiable execution across untrusted environments. For more information, visit www.openmatter.network.

Contact

Caleigh McDaniel
caleigh@griffin360.com