U.S. military data left exposed at an a16z startup for 150 days
An a16z-backed DoD contractor, Schemata, left highly sensitive military training data and U.S. service member records exposed for 150 days due to a complete lack of API authorization. This story highlights critical security failures even in defense-focused platforms and the arduous process of responsible disclosure. Hacker News is buzzing about the egregious security lapse, the company's slow response, and the implications for national security.
The Lowdown
Strix, an autonomous AI hacking agent, uncovered a catastrophic security vulnerability at Schemata, an Andreessen Horowitz-backed company holding active Department of Defense contracts. Schemata's AI-powered virtual training platform for the military had virtually no authorization layer on its API, leaving highly sensitive data completely exposed. This foundational failure allowed a low-privilege account to access a vast array of confidential information, underscoring severe risks for national security and service members.
- Vulnerability Discovery: Strix, initially used as a benchmark for the platform, easily bypassed any supposed authorization with a standard user account, demonstrating a complete lack of tenant isolation and permission checks.
- Exposed Data: The vulnerability exposed the entire user base (including names, emails, bases of U.S. service members), hundreds of confidential military training manuals (some explicitly marked 'confidential' and covering sensitive topics like explosive ordnance handling), and even allowed potential modification or deletion of courses.
- Disclosure Ordeal: Strix attempted a responsible disclosure for 150 days, starting December 2, 2025. Schemata's CEO initially questioned their motives, and the company failed to respond to multiple follow-ups regarding the critical vulnerability. Remediation only occurred on May 1, 2026, after Strix informed them of impending publication.
- Regulatory Implications: The exposure likely constitutes a reportable incident under federal regulations like DFARS 252.204-7012 and CMMC, given the handling of Controlled Unclassified Information (CUI).
- Call to Action: Strix urges Schemata customers to demand transparency regarding the breach and advises developers to prioritize robust authorization and continuous security validation, especially for sensitive data.
The Gossip
Acronym Acrimony
The initial comments quickly pivoted to a discussion about the use of the 'a16z' acronym in the title. Some users found it obscure and requested clarification, while others defended its common usage within the tech community, especially among HN readers. The author promptly acknowledged the feedback and updated the title for clarity.
Accountability Anxieties
A significant point of contention arising from the story was the perceived lack of accountability for Schemata and its leadership. Commenters expressed concern and outrage over the company's egregious security failure, especially given its role as a DoD contractor handling highly sensitive military data, and the CEO's initial dismissive response to the vulnerability disclosure.