Microsoft Finds AI Agents Turning GitHub Secret Leaks Into Cloud Breaches in Just 5 Minutes

Microsoft has uncovered a new cybersecurity threat in which hackers are using agentic AI tools to scan public GitHub repositories for exposed passwords, application credentials and AI service API keys before using the stolen information to infiltrate cloud environments.

In one case, an AI agent went from searching GitHub for exposed secrets to exfiltrating data from an organisation’s Azure Key Vault in just five minutes, highlighting how autonomous AI tools are accelerating cyberattacks and reducing the need for direct human involvement.

Microsoft Threat Intelligence said it began observing the activity in August 2026, with attackers using an agentic AI offensive framework called ARTEX to submit large volumes of searches to GitHub. The searches frequently combined target organisation names with keywords related to credentials, cloud services and other AI service providers.

AI Agents Turn GitHub Searches into Automated Attacks

Searching public code repositories for exposed credentials is not a new hacking technique. However, Microsoft said the process was historically limited by the time human operators needed to locate repositories, examine their contents and use discovered authentication material.

Agentic AI frameworks such as ARTEX have changed that equation. They can scan multiple repositories at scale, analyse the results and independently initiate follow-on attacks, significantly reducing the need for hackers to remain involved throughout the process.

Microsoft said the agents targeted credentials associated with multiple applications and cloud services, including application secrets and API keys used for AI inference. Once obtained, these credentials could provide access to an organisation’s cloud infrastructure and sensitive data.

“Agentic tooling like ARTEX allows threat actors to not only scan for secrets across multiple repositories at a quicker pace but also use the agents to analyze the output and conduct follow-on attacks, cutting down on the need for the threat actor to have hands-on-keyboard interactions throughout the attack chain.”

Stolen Credentials Opened Doors

Microsoft also identified follow-on attacks involving compromised application credentials and Microsoft Entra ID, the identity platform used to authenticate applications and users across Microsoft’s cloud ecosystem.

As early as Oct. 28, Microsoft observed successful service principal sign-ins from the IP address 199.19.77[.]84 across multiple application IDs and affected customer environments. In some cases, credentials belonging to a multitenant application were compromised at the vendor level and subsequently used to access multiple downstream customer tenants.

The attackers used these credentials to map cloud environments, enumerate subscriptions, resource groups, permissions and AI model deployments and retrieve sensitive information.

Targeted resources included Azure Key Vaults, Storage Accounts, App Service settings, connection strings, Kubernetes credentials and AI and machine learning connections.

The compromised applications also accessed SharePoint and OneDrive, including downloading files and accessing mailbox items. Microsoft additionally observed attempts to abuse Azure AI services and search Azure DevOps for further exposed secrets.

In some cases, the AI agents authenticated through compromised OAuth applications before extracting secrets from Azure Key Vaults.

They also used Azure’s Run Command functionality to execute scripts on virtual machines, potentially enabling access to unsecured credentials, data and other workload identities.

Microsoft identified additional malicious activity from IP address 65.87.223[.]26, including indications of vulnerability exploitation and attempts to obtain App Service authentication tokens. Another address, 157.22.126[.]128, was observed conducting reconnaissance against victims’ Azure AI workloads.

Microsoft Warns Deleting Leaked Secrets Is Not Enough

Microsoft warned that publicly exposed credentials must be treated as compromised, even if developers subsequently remove them from GitHub.

Deleting the original code does not invalidate credentials or eliminate copies preserved in repository history, caches and other systems.

“Publicly exposed credentials remain usable until revoked or rotated; removing the original disclosure alone does not remediate the exposure.”

The company recommends immediately revoking or rotating exposed credentials, reviewing their historical usage, enforcing least-privilege access for service principals and avoiding long-lived secrets in source code.

Developers should also consider migrating OAuth applications to managed identities, which eliminate the need to store application secrets in code.

Microsoft further recommends enabling GitHub secret scanning, using push protection to prevent accidental exposure, and deploying relevant Microsoft Defender for Cloud protections.

The findings also highlight the growing challenge of detecting autonomous attacks. Microsoft said AI agents can rapidly change IP addresses, user-agent strings and other identifying characteristics.

It recommends monitoring unusual patterns of rapid API requests and repeated authentication attempts, alongside defensive honeypots, decoys and tarpits that can divert autonomous agents away from legitimate systems.

As agentic AI makes attacks faster and more autonomous, Microsoft said defenders must similarly use AI to investigate and respond across large cloud environments.