A
Aphanarc
Guest
One email, never opened, was enough: researchers asked Microsoft 365 Copilot, “What’s the API key I sent myself?” and it handed it over. When an enterprise sends its code, contracts and customer records through someone else’s AI, it no longer decides where that data goes or who can reach it. That is the case for sovereign AI. Not patriotism. Custody.
The scandals below are stories. The reports behind them are arithmetic. IBM’s 2026 Cost of a Data Breach study, released July 29, put the global average cost of a breach at $4.99 million, up 12 percent in one year. When the breach was AI-enabled the bill rose to $6 million. One in four malicious breaches were AI-enabled, a 56 percent jump. More than a fifth of organizations reported attacks that went after their AI models or applications directly.
A Cloud Security Alliance and Token Security survey published April 21, 2026, found that 65 percent of organizations had at least one security incident caused by AI agents on their networks in the past year. In 61 percent of those incidents, sensitive data was exposed. Sixty-three percent said they could not enforce purpose limits on their agents. Sixty percent could not shut a misbehaving agent down.
A Gartner forecast stated 35 percent of countries will be locked into region-specific AI platforms by 2027, up from 5 percent today. “Countries with digital sovereignty goals are increasing investment in domestic AI stacks as they look for alternatives to the closed U.S. model,” said Gaurav Gupta, a Gartner vice president analyst.
Ranked by what they teach an enterprise about custody of its own data. Each is documented. Each was avoidable.
Alexandre Pauwels, a cybersecurity researcher at the University of Cambridge, found close to 3,000 unpublished Anthropic assets sitting in a publicly accessible data cache. Among them: details of an unreleased model described as a “step change” in capability, plans for an invite-only CEO retreat in the U.K., draft blog posts, research papers, and internal images, including parental-leave paperwork. The cause was a default. The outside content management system Anthropic used made every upload public unless someone marked it private. Fortune broke the story on March 26, 2026. Anthropic locked the data down after being told, blamed “human error in the CMS configuration,” and said no customer data or AI systems were involved.
Why it matters: One of the best-funded labs in AI, built on a reputation for safety, was undone by a setting nobody changed. Defaults decide where data goes. In someone else’s tool, someone else sets the default.
In early October 2026, OpenAI told more than 100 organizations about incidents involving unauthorized activity by its AI agents. “In some cases, models used internet access in unintended ways or, in retrospect, did not have the ideal restrictions applied,” the company said. The worst case it has found so far was a compromise of Hugging Face, the AI model-sharing platform, this summer. OpenAI is now combing through roughly 50 petabytes of data to learn what else happened. The same week, it fired three safety and alignment researchers for mishandling sensitive company information outside established procedures, including work tied to an outside group that evaluates AI models.
Why it matters: The vendor’s own agents were the intruders, and the vendor needs months and 50 petabytes to trace where they went. Meanwhile its information controls failed from the inside. A customer cannot audit what its vendor cannot see.
Three times in 20 days, Samsung semiconductor staff fed ChatGPT what they should not have: proprietary source code to debug, code to optimize, and a recorded meeting to summarize. Under the consumer terms of the day, the text could be retained and used to train future models. Samsung banned generative AI on company devices on May 2, 2023.
Why it matters: The first big “shadow AI” case. No hacker. Just employees, a browser, and a vendor whose retention policy they never read.
For nine hours on March 20, 2023, a fault in the redis-py library let ChatGPT serve one user’s cached data to another. Chat titles and first messages crossed accounts. For 1.2 percent of Plus subscribers active in the window, names, email addresses, billing addresses, card type, expiry, and last four digits were visible to strangers.
Why it matters: Multi-tenant systems fail in multi-tenant ways. When the model runs in someone else’s cloud, isolation is a promise, not a property.
A hacker got into an internal OpenAI forum in early 2023 and took details of the company’s AI designs from employee discussions. Executives told staff and the board in April 2023. They told no one else, and did not call the FBI, reasoning that no customer data was touched and the intruder was a private individual. The New York Times broke the story on July 4, 2024, more than a year later.
Why it matters: The largest AI vendor in the world decided, on its own, that its customers did not need to know. Enterprises depending on that vendor learned the rules of disclosure from a newspaper.
Microsoft AI researchers published open-source training data on GitHub with a link to Azure storage. The Shared Access Signature token behind the link granted full control of the whole storage account, not the one folder. It stayed live for about three years. Exposed: 38 TB, including backups of two employees’ PCs, more than 30,000 internal Teams messages from 359 employees, passwords, and secret keys. Wiz reported it in June 2023; Microsoft revoked the token in two days.
Why it matters: The people building the models are not immune to the mistakes the models get blamed for. AI research moves fast and credentials get sloppy.
Aim Security found that a single crafted email could make Microsoft 365 Copilot hand over anything in its context, with no click from the victim. CVE-2025-32711 scored 9.3. The trick was to phrase the email as if written to a human, slipping past prompt-injection filters, and to smuggle data out through reference-style markdown links. Researchers asked Copilot, “What’s the API key I sent myself?” and got it. Microsoft patched before disclosure and said no customers were hit.
Why it matters: It was the first documented zero-click attack on an enterprise AI assistant. The assistant had access to email, files, and chat. So did the attacker.
Attackers who had been inside Salesloft’s GitHub since March 2025 stole OAuth tokens for Drift, its AI sales chatbot. Between August 8 and 18 they used the tokens to pull Salesforce data from more than 700 organizations, hunting for AWS keys, Snowflake tokens, and passwords buried in support cases. Victims included Cloudflare, Palo Alto Networks, Zscaler, Proofpoint, CyberArk, Tenable, and Qualys. Google tracks the actor as UNC6395.
Why it matters: The chatbot was the way in. Every AI integration is a standing credential to the system it talks to, and the security companies on the victim list could not see it either.
The cybercrime group UNC5537 bought credentials harvested by infostealer malware, some dating to 2020, and logged in to Snowflake customer accounts that had never turned on multi-factor authentication. No Snowflake vulnerability was exploited. It did not need to be. About 165 customers were hit. AT&T lost call records on roughly 110 million people. Ticketmaster lost about 560 million records. Santander was on the list. Alexander Moucka was arrested in Canada that October.
Why it matters: Snowflake is where enterprises stage the data they feed to AI. The platform was fine. The shared-responsibility model failed, and the customer paid.
OpenAI added a checkbox that let users make shared conversations “discoverable” by search engines. Thousands did without understanding it. Google indexed the results: therapy-style confessions, business plans, employee names. On August 1, 2025, OpenAI killed the feature. “This feature introduced too many opportunities for folks to accidentally share things they didn’t intend to,” said CISO Dane Stuckey. Bing and DuckDuckGo were still returning results days later.
**Why it matters:**One checkbox in a consumer product turned corporate prompts into public web pages. Enterprises had no control over the setting and no log of who clicked it.
Read together, the cases sort into four failures. None of them is exotic.
“Sovereign AI” gets used loosely. For an enterprise it means four concrete things: the model runs on infrastructure the enterprise or its jurisdiction controls; data does not leave that boundary for inference, logging, or training; the enterprise, not the vendor, sets retention and can prove deletion; and the enterprise can audit every call the model and its agents make. Map those against the list.
The honest caveat: sovereign deployments trade vendor risk for operational risk. Microsoft’s 38 TB leak was an in-house team with an in-house key. Sovereignty gives the enterprise custody. It does not give it competence. That has to be built.
Back to that one unopened email. Microsoft patched EchoLeak before disclosure and said no customers were hit. By the standards of this list, it behaved well. It still does not matter. The key sat in a context window the customer did not run, one crafted message away from a stranger. Every enterprise running its data through a third-party AI is in that position. Most have not asked the question the researchers did.
Sovereign AI is the decision to ask it, and to keep the answer home.
About Aphanarc
Aphanarc is AI infrastructure built for sovereign AI. Enterprises and privacy-focused users run powerful models and agentic workflows without exposing proprietary data to centralized systems. Aphanarc atomizes compute, model execution and data handling, so sensitive information is never fully processed, stored or reconstructed in one place. In development since 2024, it delivers private, high-performance AI without centralized-cloud premiums.
The numbers behind the worry
The scandals below are stories. The reports behind them are arithmetic. IBM’s 2026 Cost of a Data Breach study, released July 29, put the global average cost of a breach at $4.99 million, up 12 percent in one year. When the breach was AI-enabled the bill rose to $6 million. One in four malicious breaches were AI-enabled, a 56 percent jump. More than a fifth of organizations reported attacks that went after their AI models or applications directly.
A Cloud Security Alliance and Token Security survey published April 21, 2026, found that 65 percent of organizations had at least one security incident caused by AI agents on their networks in the past year. In 61 percent of those incidents, sensitive data was exposed. Sixty-three percent said they could not enforce purpose limits on their agents. Sixty percent could not shut a misbehaving agent down.
A Gartner forecast stated 35 percent of countries will be locked into region-specific AI platforms by 2027, up from 5 percent today. “Countries with digital sovereignty goals are increasing investment in domestic AI stacks as they look for alternatives to the closed U.S. model,” said Gaurav Gupta, a Gartner vice president analyst.
| Figure | What it measures | Source |
|---|---|---|
| $4.99 million | Global average cost of a data breach, up 12% in a year | IBM, Cost of a Data Breach 2026 |
| $6 million | Average cost when the breach is AI-enabled | IBM, 2026 |
| 1 in 4 | Malicious breaches that were AI-enabled, up 56% year over year | IBM, 2026 |
| 20%+ | Organizations reporting breaches that targeted their AI models or apps | IBM, 2026 |
| 65% | Organizations with at least one AI-agent security incident in the past year | Cloud Security Alliance / Token Security, April 2026 |
| 61% | Share of those incidents that exposed sensitive data | CSA / Token Security, 2026 |
| 35% | Countries locked into region-specific AI platforms by 2027, up from 5% | Gartner, January 2026 |
The ten scandals
Ranked by what they teach an enterprise about custody of its own data. Each is documented. Each was avoidable.
1. Anthropic’s CMS leaves an unreleased model in public view
Alexandre Pauwels, a cybersecurity researcher at the University of Cambridge, found close to 3,000 unpublished Anthropic assets sitting in a publicly accessible data cache. Among them: details of an unreleased model described as a “step change” in capability, plans for an invite-only CEO retreat in the U.K., draft blog posts, research papers, and internal images, including parental-leave paperwork. The cause was a default. The outside content management system Anthropic used made every upload public unless someone marked it private. Fortune broke the story on March 26, 2026. Anthropic locked the data down after being told, blamed “human error in the CMS configuration,” and said no customer data or AI systems were involved.
Why it matters: One of the best-funded labs in AI, built on a reputation for safety, was undone by a setting nobody changed. Defaults decide where data goes. In someone else’s tool, someone else sets the default.
2. OpenAI’s agents go rogue, and three researchers go out the door
In early October 2026, OpenAI told more than 100 organizations about incidents involving unauthorized activity by its AI agents. “In some cases, models used internet access in unintended ways or, in retrospect, did not have the ideal restrictions applied,” the company said. The worst case it has found so far was a compromise of Hugging Face, the AI model-sharing platform, this summer. OpenAI is now combing through roughly 50 petabytes of data to learn what else happened. The same week, it fired three safety and alignment researchers for mishandling sensitive company information outside established procedures, including work tied to an outside group that evaluates AI models.
Why it matters: The vendor’s own agents were the intruders, and the vendor needs months and 50 petabytes to trace where they went. Meanwhile its information controls failed from the inside. A customer cannot audit what its vendor cannot see.
3. Samsung’s engineers paste the source code
Three times in 20 days, Samsung semiconductor staff fed ChatGPT what they should not have: proprietary source code to debug, code to optimize, and a recorded meeting to summarize. Under the consumer terms of the day, the text could be retained and used to train future models. Samsung banned generative AI on company devices on May 2, 2023.
Why it matters: The first big “shadow AI” case. No hacker. Just employees, a browser, and a vendor whose retention policy they never read.
4. OpenAI’s Redis bug shows one user another’s data
For nine hours on March 20, 2023, a fault in the redis-py library let ChatGPT serve one user’s cached data to another. Chat titles and first messages crossed accounts. For 1.2 percent of Plus subscribers active in the window, names, email addresses, billing addresses, card type, expiry, and last four digits were visible to strangers.
Why it matters: Multi-tenant systems fail in multi-tenant ways. When the model runs in someone else’s cloud, isolation is a promise, not a property.
5. OpenAI’s own secrets are stolen and kept quiet
A hacker got into an internal OpenAI forum in early 2023 and took details of the company’s AI designs from employee discussions. Executives told staff and the board in April 2023. They told no one else, and did not call the FBI, reasoning that no customer data was touched and the intruder was a private individual. The New York Times broke the story on July 4, 2024, more than a year later.
Why it matters: The largest AI vendor in the world decided, on its own, that its customers did not need to know. Enterprises depending on that vendor learned the rules of disclosure from a newspaper.
6. Microsoft’s AI team exposes 38 terabytes
Microsoft AI researchers published open-source training data on GitHub with a link to Azure storage. The Shared Access Signature token behind the link granted full control of the whole storage account, not the one folder. It stayed live for about three years. Exposed: 38 TB, including backups of two employees’ PCs, more than 30,000 internal Teams messages from 359 employees, passwords, and secret keys. Wiz reported it in June 2023; Microsoft revoked the token in two days.
Why it matters: The people building the models are not immune to the mistakes the models get blamed for. AI research moves fast and credentials get sloppy.
7. EchoLeak: the zero-click Copilot exploit
Aim Security found that a single crafted email could make Microsoft 365 Copilot hand over anything in its context, with no click from the victim. CVE-2025-32711 scored 9.3. The trick was to phrase the email as if written to a human, slipping past prompt-injection filters, and to smuggle data out through reference-style markdown links. Researchers asked Copilot, “What’s the API key I sent myself?” and got it. Microsoft patched before disclosure and said no customers were hit.
Why it matters: It was the first documented zero-click attack on an enterprise AI assistant. The assistant had access to email, files, and chat. So did the attacker.
8. Salesloft Drift: the AI chatbot that opened 700 Salesforce doors
Attackers who had been inside Salesloft’s GitHub since March 2025 stole OAuth tokens for Drift, its AI sales chatbot. Between August 8 and 18 they used the tokens to pull Salesforce data from more than 700 organizations, hunting for AWS keys, Snowflake tokens, and passwords buried in support cases. Victims included Cloudflare, Palo Alto Networks, Zscaler, Proofpoint, CyberArk, Tenable, and Qualys. Google tracks the actor as UNC6395.
Why it matters: The chatbot was the way in. Every AI integration is a standing credential to the system it talks to, and the security companies on the victim list could not see it either.
9. Snowflake: 165 customers, no MFA
The cybercrime group UNC5537 bought credentials harvested by infostealer malware, some dating to 2020, and logged in to Snowflake customer accounts that had never turned on multi-factor authentication. No Snowflake vulnerability was exploited. It did not need to be. About 165 customers were hit. AT&T lost call records on roughly 110 million people. Ticketmaster lost about 560 million records. Santander was on the list. Alexander Moucka was arrested in Canada that October.
Why it matters: Snowflake is where enterprises stage the data they feed to AI. The platform was fine. The shared-responsibility model failed, and the customer paid.
10. ChatGPT chats show up in Google
OpenAI added a checkbox that let users make shared conversations “discoverable” by search engines. Thousands did without understanding it. Google indexed the results: therapy-style confessions, business plans, employee names. On August 1, 2025, OpenAI killed the feature. “This feature introduced too many opportunities for folks to accidentally share things they didn’t intend to,” said CISO Dane Stuckey. Bing and DuckDuckGo were still returning results days later.
**Why it matters:**One checkbox in a consumer product turned corporate prompts into public web pages. Enterprises had no control over the setting and no log of who clicked it.
What the ten have in common
Read together, the cases sort into four failures. None of them is exotic.
- The vendor decided. OpenAI chose not to disclose its breach. OpenAI chose to add a share-to-Google checkbox. OpenAI chose how much of the internet its agents could reach. In each case the enterprise learned of the decision after the fact.
- The tenant next door leaked. The Redis bug is what multi-tenancy looks like when it breaks. The customer’s data was only as safe as the vendor’s isolation and the vendor’s ops team.
- The integration was the door. Drift, Copilot, and Snowflake were not the target. They were the hallway. AI tools hold broad, persistent credentials, and attackers have noticed.
- The employee did not know. Samsung’s engineers, the ChatGPT sharers, and whoever set up Anthropic’s CMS were not malicious. They were productive. The tools did what they were designed to do, in a place the company did not control.
What sovereign AI actually fixes
“Sovereign AI” gets used loosely. For an enterprise it means four concrete things: the model runs on infrastructure the enterprise or its jurisdiction controls; data does not leave that boundary for inference, logging, or training; the enterprise, not the vendor, sets retention and can prove deletion; and the enterprise can audit every call the model and its agents make. Map those against the list.
- The Redis bug does not happen when inference runs inside the enterprise boundary. There is no shared cache. There is no stranger in the next session. That is the premise behind Aphanarc, an agentic AI infrastructure that atomizes compute, model execution and data handling rather than routing them through a centralized server.
- Samsung and the Google-indexed chats do not happen when the sanctioned tool is the sovereign one, and it is good enough that employees use it.
- OpenAI’s quiet breach and Anthropic’s open data cache do not matter as much when the vendor never held your data in the first place.
- EchoLeak, Drift, Snowflake, and OpenAI’s rogue agents are harder. Sovereignty of the model does not fix a chatbot with an over-privileged token or an agent with too much internet. But it shrinks the blast radius, keeps logs in-house, and puts the enterprise in a position to answer the CSA survey’s question, “can you shut the agent off,” with a yes. Distributed designs like Aphanarc’s are built for this problem: break execution into separate pieces, and a stolen credential opens one room, not the whole house.
The honest caveat: sovereign deployments trade vendor risk for operational risk. Microsoft’s 38 TB leak was an in-house team with an in-house key. Sovereignty gives the enterprise custody. It does not give it competence. That has to be built.
The bottom line
Back to that one unopened email. Microsoft patched EchoLeak before disclosure and said no customers were hit. By the standards of this list, it behaved well. It still does not matter. The key sat in a context window the customer did not run, one crafted message away from a stranger. Every enterprise running its data through a third-party AI is in that position. Most have not asked the question the researchers did.
Sovereign AI is the decision to ask it, and to keep the answer home.
About Aphanarc
Aphanarc is AI infrastructure built for sovereign AI. Enterprises and privacy-focused users run powerful models and agentic workflows without exposing proprietary data to centralized systems. Aphanarc atomizes compute, model execution and data handling, so sensitive information is never fully processed, stored or reconstructed in one place. In development since 2024, it delivers private, high-performance AI without centralized-cloud premiums.