Microsoft has filed a lawsuit against a group accused of bypassing safety measures in its Azure OpenAI Service, alleging unlawful access through stolen customer credentials and custom software.

The company claims the defendants, known as “Does,” exploited stolen API keys to generate content violating the service’s acceptable use policy, enabling a “hacking-as-a-service” scheme via a program called “de3u.”

This program allowed users to bypass content filtering systems and reverse-engineer security measures.

Microsoft discovered the misuse in July 2024 after identifying theft of API keys from US customers.

In response, Microsoft enhanced its safeguards, obtained a court order to seize a related website, and seeks damages and injunctions.