Microsoft says attackers are using an agentic artificial intelligence framework to hunt for exposed secrets in public code, then using what they find to break into cloud accounts. The company’s Threat Intelligence team reported on November 5 that the framework, called ARTEX, has been scanning public GitHub repositories for credentials since August 2026. In one observed case, an AI agent moved from searching GitHub for application secrets to stealing data from an Azure Key Vault in just five minutes.
## How the attack chain worked
Secret hunting in public code is not new, but Microsoft says the agents changed the pace and the reach of the work. Human operators once had to find each repository, read the code and judge whether a leaked credential was worth using. ARTEX does the scanning and the first round of analysis itself.
The queries submitted by the framework often pair a target organization’s name with words for secrets, a cloud service or an AI provider. Once a secret is found, the agents do not stop at collection: they test the credential, work out what it unlocks and move on to the next stage of the attack without waiting for a human operator.
## The five-minute break-in
The sharpest detail in Microsoft’s report is the speed. In one case, an AI agent went from searching GitHub for a client’s application secrets to pulling data out of the organization’s Azure Key Vault in just five minutes. Key Vault stores a company’s most sensitive credentials, so reaching it that fast turns one leaked snippet into a full cloud compromise.
Microsoft also traced follow-on attacks that began as early as October 28, when stolen application credentials were used to sign in as service principals across several customer tenants. In some cases a multi-tenant credential was compromised at its source, a vendor-owned application, and then used to reach multiple downstream tenants.
The sign-ins came mainly from the address 199.19.77.84, with a second address, 199.19.77.18, identified as a Tor exit node. Microsoft also flagged two more addresses linked to the campaign, one seen trying to obtain App Service authentication tokens and another conducting reconnaissance against Azure AI workloads.
The agents also showed an unsettling habit: after a failed cloud request, they corrected the error and tried again within a minute. One batch of requests failed with an HTTP 400 error, then succeeded about 28 seconds later once the agent switched to a supported API version. It is adaptive troubleshooting, done at machine speed.
## What the agents went after
Once inside, the agents went straight for the keys that unlock more keys. They targeted storage account keys, App Service settings, connection strings, publishing credentials and the credentials for AI and machine learning connections, datastores and AKS credentials. They downloaded files from SharePoint and OneDrive, read mailbox items and mapped subscriptions, permissions and AI model deployments across the victim’s cloud.
## Our Read
This report matters because it shows the other side of the agent boom. The same week, [OpenAI shipped a defensive model](https://geroundtable.com/gpt-6-cyber-critical-security-model/) built to find vulnerabilities, while agent frameworks keep getting better at chaining tasks together. ARTEX shows what happens when that chaining is pointed at the weakest link in most companies: a secret somebody once pasted into public code.
The attack needs no zero-day and no phishing email, only a credential that was never revoked. That is the uncomfortable part of Microsoft’s advice: deleting the leaked code is not enough, because copies live on in edit history, caches and logs. The fix is unglamorous — rotate the secret, scan the repositories and replace long-lived credentials with managed identities.
## Why It Matters
The five-minute timeline is the story. Security teams have long assumed a leaked secret takes time to exploit, giving them a window to find and rotate it. An agent that scans, tests, corrects its own errors and exfiltrates in minutes leaves almost no window. Every company with public code must now assume its exposed secrets are already in use.
## Background
Microsoft’s report is the third major ARTEX sighting in recent weeks. [Zscaler documented](https://geroundtable.com/zscaler-ai-assisted-hacking-campaign-artex-models/) a financially motivated operator using the framework across 19 countries, and [CrowdStrike described](https://geroundtable.com/crowdstrike-vapor-panda-artex-agents-200/) one operator steering agents at more than 200 organizations. The new report shows the same tooling turned on cloud credentials.
Source: [Microsoft Threat Intelligence report](https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/)
0 Comments