Storm-0558: forged tokens crossed an email trust boundary

What was reported

Microsoft reported that Storm-0558 accessed email accounts at approximately 25 organizations, including government agencies, beginning May 15, 2023. Attackers used a consumer signing key to forge tokens accepted for enterprise email. Microsoft described a token-validation issue and said it blocked use of the acquired key.

Read the report from Microsoft

Our perspective

Our reading: An apparent permission can be accepted outside its proper boundary. Tool-specific access needs verification at the receiving side, not just an instruction asking the tool to behave.

Limits of this connection

This concerns identity infrastructure, not AI prompt behavior. The report does not establish a way for Vivendur to prevent signing-key theft or repair token validation.