“By executing arbitrary code, we were able move laterally and take over the service”
SAP AI Core runs customer training jobs, which means it runs customer code by design. Wiz started as an ordinary customer and found six EFS shares open with no credentials, full of training data sorted by customer ID. An unauthenticated Helm v2 Tiller server gave write access to SAP’s container registry and the whole Kubernetes cluster, including customers’ AWS and HANA secrets. SAP sells AI on top of everyone’s crown-jewel data and guarded it with defaults.