Wiz researchers discovered a single credential that could unlock every database running on Microsoft’s Azure Cosmos DB. They named it the Cosmos Master Key. The vulnerability hunter that helped find it was not entirely human. Microsoft has patched the flaw, disclosed on Thursday and dubbed CosmosEscape. It found no evidence anyone exploited it beyond Wiz’s own testing, and says customers need to do nothing. But the scope was the alarming part.

Key facts at a glance

• Wiz discovered CosmosEscape, a flaw in Azure Cosmos DB that exposed a master key for all databases in a region.
• Microsoft patched the vulnerability and found no evidence of malicious exploitation beyond Wiz’s testing; customers need to take no action.
• Wiz’s research was assisted by Atlas, an early version of the company’s AI vulnerability researcher.
• Atlas combines multiple AI models, including Anthropic’s Claude Opus 4.6 and OpenAI’s GPT-5.5, routing each stage of a job to whichever model is best at it.
• Microsoft’s own MDASH harness scored higher than several single models on the CyberGym benchmark while cutting costs by roughly half.

What made CosmosEscape alarming

Cosmos DB is core Azure plumbing. It is a globally distributed, multi-model database service used for mission-critical workloads across Microsoft’s cloud. Microsoft services such as Teams, Entra ID and Copilot all store data in it. The database service supports document, key-value, graph, and columnar data models, and it is marketed for its low latency and high availability. But with that central role comes a serious risk: a single weakness in the service could expose an enormous amount of customer and corporate data.

Wiz described CosmosEscape as a case where a working exploit could list every account in a region, then pull the primary key for any of them. A primary key in Cosmos DB grants full read and write access to the database account. That is effectively total control. An attacker with such a key could read, modify, or delete data stored across the affected databases. The exposure reached Microsoft’s own internal databases, too, meaning the stakes were not limited to third-party customers. For a while, the potential blast radius was as large as an entire cloud region.

What made the find even more significant was how it was made. The research was assisted by an early version of Atlas, Wiz’s AI vulnerability researcher. The same class of tool that broke into companies this month helped find a master key to a flagship cloud. That fact signals a clear shift in the cybersecurity landscape: AI is no longer just a theoretical aid or a marketing buzzword. It is becoming a practical instrument for discovering vulnerabilities that human researchers might miss.

How Atlas works

Atlas is not one model. Wiz has been open about its design: the agent pairs Anthropic’s Claude Opus 4.6 with OpenAI’s GPT-5.5, and routes each stage of a job to whichever model is best suited for it. This is a deliberate architecture. No single model is best at everything, and none stays state of the art for long. By combining models, Wiz can use the strongest reasoning model for one phase, a different model for another phase, and then have the system evaluate its own results and adapt.

This week Wiz said that this multi-model approach beat Anthropic’s Mythos Preview and OpenAI’s GPT-5.5 Cyber on the CyberGym benchmark, scoring 90.9 percent. The company also said Atlas uncovered more than 200 zero-day holes in open-source code. The numbers are impressive, but the deeper point is architectural. Instead of treating one frontier model as a universal answer, Wiz treats models as components in a larger pipeline. Each model contributes what it does best, and the system orchestrates the work.

Wiz is already planning to add Google’s Gemini Flash Cyber to the lineup. The company’s researchers wrote that the key is continuous improvement and flexibility. Models change quickly, and a security tool that depends on a single vendor’s model will quickly fall behind. An orchestration layer lets Wiz swap in new models as they appear, which is important in a field where the state of the art shifts every few months.

Microsoft’s response and its own AI harness

Microsoft is chasing the same idea with its own system, known as MDASH. According to Microsoft, MDASH scored 95.95 percent on CyberGym, beating Mythos, Gemini, and GPT. The system splits work between red-team agents that find exploitable flaws and green-team agents that patch them. This mirrors the way human security teams operate: one side attacks, the other side defends, and the back-and-forth improves the overall result.

MDASH is also designed to be efficient. It runs a small in-house model, MAI-Cyber-1-Flash, for up to 90 percent of tasks, and hands the hardest 10 percent to the larger GPT-5.4. This hybrid approach is meant to get frontier-level performance without paying frontier-level costs for every single operation. Microsoft AI chief Mustafa Suleyman said the models deliver better performance than all of the other models combined, at 50 percent of the cost. That kind of cost reduction matters for real-world deployment.

The single-model scores on the same benchmark show the gap. GPT-5.5 Cyber managed 85.6 percent, Anthropic’s Mythos 5 hit 83.8 percent, and Google’s Gemini 3.5 Flash Cyber reached 83.2 percent. Stitched together, the systems beat all of them. This is a recurring pattern in AI security research: combined models consistently outperform individual models. It is not because one model is smarter than another in every way. It is because different models have different blind spots, and careful orchestration can cover those blind spots.

The bigger shift toward AI-assisted bug hunting

CosmosEscape is far from the first example of AI helping security researchers. Over the past year, AI agents have participated in hacking competitions, discovered memory safety bugs, and sifted through massive codebases to find vulnerabilities. But the Cosmos DB finding is notable because it involved a flagship cloud service and a master key with massive reach. It is one thing for an AI to find a memory-corruption bug in an open-source library. It is another thing for an AI-assisted tool to find a single credential that unlocks thousands of databases.

The pattern is also moving from research labs to production tooling. Cloud security companies are building AI agents directly into their vulnerability management platforms. These agents can continuously scan code, analyze configurations, and search for attack paths. They are becoming faster and more reliable, though their results still need human review. The goal is not to replace human researchers but to multiply their effectiveness.

There is also a defensive side to this story. Microsoft patched CosmosEscape before any reported exploitation, and the company’s AI harness is designed to find vulnerabilities before attackers do. The use of green-team agents that patch flaws automatically is an important development. In the past, discovering a vulnerability was only the first step; fixing it could take weeks. With AI-assisted patching, the time between discovery and remediation could shrink dramatically.

The caveats and remaining challenges

A few things temper the hype. The CyberGym figures are the vendors’ own, and Atlas is not for sale. It runs inside Wiz’s environment, so independent researchers cannot easily reproduce the results or test them in different settings. A benchmark win is not the same as a production track record. Benchmarks measure a controlled set of tasks, while real-world codebases are messy, full of legacy code, and constantly changing.

There is a cost problem, too. Pointing a frontier model at a codebase once is expensive, and the result goes stale as code changes by the minute. A vulnerability found today may not matter tomorrow if the surrounding code has changed. This is why Wiz’s Nir Ohfeld argues that the real test is whether a system keeps finding flaws continuously and economically as better models arrive. A one-time expensive scan is less useful than an always-on system that can keep up with modern development speed.

There is also the dual-use problem. The same AI models that help defenders find and patch vulnerabilities can help attackers find and exploit them. Wiz aimed its tools at Azure and found a master key. The past month is a reminder that attackers can aim similar tools just as easily. This is not a reason to stop developing AI security tools, but it is a reason to take the threat seriously and invest in defenses that can keep pace.

CosmosEscape is the proof of concept either way. It shows that multi-model AI systems have reached the point where they can discover critical flaws in the most important cloud infrastructure. It also shows that the window between discovery and exploitation is shrinking. The winners in this new era will be those who can continuously and economically combine the best available models, apply them to real-world systems, and act on their findings before anyone else does.

Source:TNW | Anthropic News