Category: AI Agent Security | Reading time: 3 min
Microsoft Threat Intelligence reported on November 5 that attackers are using the ARTEX agentic offensive framework to mass-search public GitHub for credentials, application secrets and AI API keys, then use those secrets against the victim's cloud with almost no human at the keyboard. In at least one case, an agent advanced from scanning GitHub for secrets to exfiltrating data from Azure Key Vault in five minutes.
What Microsoft saw
Microsoft says the GitHub scanning began in August 2026. Queries often included an organization name plus keywords for secrets, cloud services or AI providers. Exposed secrets remain usable until rotated; deleting the leaked file does not fix the exposure.
From about October 28, Microsoft also observed successful service principal sign-ins from IP 199.19.77.84 across dozens of applications and multiple tenants, including cases where a multitenant vendor app credential was compromised at the source and used against downstream tenants. Compromised applications pulled storage keys, App Service settings, connection strings, AI and ML connections, AKS user credentials, SharePoint and OneDrive files, and Graph searches, and enumerated Azure subscriptions, resource groups, permissions and AI deployments.
Adaptive retries
The agent also adjusted when cloud APIs failed. Key Vault metadata calls that hit the wrong API plane returned HTTP 400, then succeeded about 28 seconds later with ARM API version 2023-07-01. Similar retries on Azure SQL firewall rules and Application Insights took roughly 60 and 80 seconds. In other cases the same tooling obtained a token for a single-tenant OAuth app, searched Azure DevOps for secrets, and used Run Command on Azure VMs.
Microsoft recommends rotating exposed secrets immediately, enabling GitHub secret scanning and public monitoring, preferring managed identities over client secrets, blocking 199.19.77.84/32 for workload identities, applying least privilege on service principals, and enabling relevant Defender for Cloud plans. It is also testing honeypots, decoys, tarpits and fake wins to pull autonomous agents off real assets.
Why it matters
Five minutes from a leaked client secret to Key Vault leaves no useful window for a human reviewer sitting on a dashboard. The same agent corrected its own failed API calls. For organizations that give agents cloud credentials, the practical requirement is to decide what each identity may do before it runs, record every action as it happens, and keep evidence that can be checked without trusting a single vendor log.
Source: Microsoft Security Blog, November 5 2026, Cyber Security News