Critical Zero-Auth Vulnerability in DoD-Linked AI Training Platform Exposed Sensitive Military Data A severe authorization flaw in Schemata, an AI-powered virtual training platform under contract with the U.S. Department of Defense (DoD), was discovered by security researcher Alex Schapiro using the open-source AI hacking tool Strix. The vulnerability, classified as a zero-authentication (zero-auth) issue, allowed unprivileged users to access and potentially manipulate highly sensitive military training materials and personnel records across tenant boundaries. ### Key Details of the Vulnerability - Discovery & Exploitation: Strix mapped Schemata’s API surface by replaying high-value endpoints with a low-privilege account, revealing that the system failed to enforce tenant isolation or permission checks. This enabled unauthorized access to data across all organizations using the platform. - Exposed Data: The flaw granted access to: - Full user directories, including names, email addresses, and military base deployments of active-duty personnel posing risks of targeted phishing and doxing. - Confidential training modules, such as 3D naval maintenance simulations and Army field manuals on explosive ordnance deployment, along with direct AWS S3 links to these assets. - Write-enabled routes, allowing potential data manipulation or deletion of critical training infrastructure. - Regulatory Implications: Schemata’s failure to implement basic API authorization violated DoD cybersecurity mandates, including DFARS 252.204-7012 and CMMC requirements for handling Controlled Unclassified Information (CUI). ### Delayed Response & Patch Timeline - December 2, 2025: Researchers first disclosed the vulnerability to Schemata, but the company initially dismissed the report as a bug bounty solicitation. - Nearly 150-Day Exposure: Despite repeated warnings, the flaw remained unpatched until May 1, 2026, when Schemata finally acknowledged and fixed the issue just before public disclosure. - Post-Patch Actions: DoD partners were advised to review access logs to assess potential data exposure during the vulnerability window. The incident underscores systemic risks in military-linked software supply chains, where inadequate authorization controls can lead to large-scale data breaches with national security implications.