Microsoft says attackers used AI agents to loot cloud secrets

Microsoft Threat Intelligence said on 5 November 2026 that it has observed threat actors using an agentic AI offensive framework to hunt for exposed secrets in public GitHub repositories and then use them to break into customers' Microsoft Entra ID tenants. In at least one case, according to the company, an AI agent moved from scanning GitHub for secrets to exfiltrating data from Azure Key Vault in just five minutes. Affected organisations included downstream tenants reached through a compromised multitenant application credential.

According to Microsoft, the activity began in August 2026, when threat actors started submitting large volumes of queries to GitHub looking for secrets. The queries often combined the name of a target organisation with keywords for secrets, cloud services or AI service providers. The secrets sought included credentials, application credentials and AI inference-related API keys across multiple applications and cloud services.

Microsoft said searching open code repositories for authentication material is a well-documented technique, but one that has historically been limited by how long it takes a human operator to find repositories, review their contents and act on what is found. Agentic tooling such as ARTEX, the framework named in Microsoft's report, lets attackers scan faster and also use agents to analyse the results and carry out follow-on attacks, cutting down on hands-on-keyboard work through the attack chain.

The follow-on activity is where the damage occurred. As early as 28 October 2026, Microsoft began observing successful service principal sign-ins from the IP address 199.19.77.84 involving multiple application IDs across some affected customers. In one case a multitenant application credential was compromised at the source, at the vendor that owned the application, and then used to reach multiple downstream tenants. Microsoft said the threat actor used the credentials for cloud resource discovery, and for credential and data exfiltration, including from Azure Key Vaults and Storage Accounts, along with abuse of Azure AI services. Sign-ins came primarily from 199.19.77.84 and 199.19.77.18, the latter a Tor exit node.

Microsoft also reported malicious activity from two further IP addresses potentially linked to the campaign. From 65.87.223.26 it identified indications of vulnerability exploitation using shell commands embedded in a user agent, and attempts to obtain App Service authentication tokens. The company said a similar campaign involving the same IP addresses was also reported by Todyl. From 157.22.126.128, Microsoft observed reconnaissance against AI workloads that victims had deployed on Azure AI services.

The company's advice is to scan code in GitHub for secrets, remove them, and immediately rotate any exposed keys or credentials. Microsoft stressed that publicly exposed credentials remain usable until revoked or rotated, and that deleting the original disclosure does not remediate the exposure. Organisations that find their secrets in public repositories, it said, must assume those secrets and the associated applications are compromised.

GitHub automatically scans public repositories for secrets, and Microsoft said organisations can enable public monitoring to detect secrets leaked in secondary public repositories elsewhere on the platform. Push protection can block supported secrets before they are committed. Longer term, Microsoft recommends developers migrate OAuth applications away from secret-based authentication to managed identities, which it said removes the possibility of secrets being exposed in code.

Microsoft framed the campaign as part of an ongoing trend of attackers accelerating every stage of the attack chain with agentic AI penetration testing frameworks, and said defenders will need to use AI in turn to investigate and respond across large environments.