Schoolboy Hacked Microsoft

30 September 2026

A 16-year-old security researcher who goes by the name Faav has found a flaw in an internal Microsoft analytics service called Titan. Working with an AI bug-hunting bot he built himself, he gained administrator access without any valid login, and could potentially have reached databases holding an estimated 17.3 trillion rows of data.

What went wrong

Titan is meant for Microsoft staff only. It checked the details written on a login token (who you are, which organisation, which app) but never checked the signature that proves the token is genuine. Faav compared it to a hotel where every door has a card reader, but any card opens any room. After ten days of failed attempts, fitted in around schoolwork, he changed one username to "admin" and was in.

He reported it through Microsoft's bug bounty programme. Microsoft locked the service down within days, thanked him publicly and paid a $5,000 reward. The 17.3 trillion figure is an estimate that probably includes duplicated and historical data, and there is no suggestion that anything was misused.

Why this matters for your business

• AI has lowered the bar. A schoolboy with a home-built AI assistant did what once took a specialist team. People with worse intentions have the same tools.
• The basics still decide it. This was one missing check, not an exotic attack. If you are having software, a website or an AI agent built for you, ask how logins are verified, and ask who has tested it.
• Know what you hold. Staff names, job titles and reporting lines were among the exposed records, which is exactly the material a convincing scam email is built from.

If it can happen to Microsoft, it can happen to a supplier you rely on. The sensible response is to keep asking plain questions about who can get at your data, and to expect plain answers.