Microsoft observed an AI agent take just five minutes to progress from hunting exposed secrets on GitHub to stealing data from Azure Key Vault, illustrating how quickly leaked credentials can become a cloud compromise. The company says attackers are using agentic AI frameworks, including ARTEX, to find authentication material in public repositories and pursue further attacks with less human intervention. Microsoft began observing the automated GitHub searches in August 2026.
The searches targeted credentials for applications and cloud services, including API keys used for AI inference. Queries frequently included a target organization's name, terms tied to secrets, or keywords pointing to cloud platforms or other AI providers. Microsoft advises organizations to treat exposed secrets and the applications associated with them as compromised, and to rotate affected credentials immediately.
Read more: SHub Reaper macOS stealer spoofs Apple Google and Microsoft in a single attack chain
By October 28, Microsoft was observing successful sign-ins using application identities across multiple affected customers. In some cases, attackers compromised credentials belonging to a vendor's multitenant application and used them to reach several downstream tenants. The subsequent activity included discovering cloud resources, stealing credentials and data, and abusing Azure AI services.
Microsoft also saw behavior consistent with agents troubleshooting failed requests: an unsuccessful attempt to inspect Azure Key Vault secret metadata was retried with a corrected API version roughly 28 seconds later and succeeded. Compromised applications accessed SharePoint and OneDrive, with activity including downloading files and accessing mailbox items. Attackers also mapped Azure environments by inspecting subscriptions, permissions, deployed AI models and service settings.
Earlier OAuth attacks offered another route into Microsoft 365: campaigns observed from September 2025 tricked users into entering device codes on Microsoft's legitimate verification page, granting attackers account access. Those campaigns produced refresh tokens that could sustain access without attackers stealing passwords or intercepting authentication codes.
Deleting a leaked secret from a repository does not invalidate it; the credential remains usable until it is revoked or rotated. Microsoft recommends moving OAuth applications away from authentication based on secrets and using managed identities to avoid embedding application credentials in code. Organizations can also enable GitHub public monitoring to find secrets exposed in repositories outside their ownership. For Azure DevOps, push protection can stop supported secrets before submission when the required GitHub security protection is enabled.
