Microsoft says threat actors are using the agentic AI offensive framework ARTEX to search public GitHub repositories for exposed secrets, including credentials, application credentials and API keys. The activity reduces the amount of hands-on work needed to move from public code discovery to authenticated cloud access.
The security issue is familiar, but the speed has changed. Searching open repositories for secrets has long been part of credential theft, but Microsoft reported at least one case in which an AI agent moved from scanning GitHub to exfiltrating data from Azure Key Vault in five minutes.
From public repository to cloud access
The activity began in August 2026, when large volumes of GitHub queries were submitted by an agentic framework. The queries often combined the target organisation’s name with terms linked to secrets, cloud services or AI service providers.
Microsoft said organisations that find secrets exposed in public repositories should treat those secrets and the associated applications as compromised. Removing the secret from the repository is not enough, because publicly exposed credentials remain usable until they are revoked or rotated.
Follow-on activity involved Microsoft Entra ID and Azure resources. As early as 28 October 2026, Microsoft saw successful service principal sign-ins from 199.19.77[.]84 involving multiple application IDs across some affected customers. In some cases, a multitenant application credential was compromised at the source and then used to access downstream tenants.
Service principals matter because they give applications direct, programmatic access to the resources they are authorised to reach. The threat actor used compromised credentials for cloud resource discovery and for credential and data exfiltration, including from Azure Key Vaults and Storage Accounts. Microsoft also observed abuse of Azure AI services in activity consistent with the same pattern.
What the agents did after sign-in
The agentic framework targeted operations that return credentials. Microsoft listed storage account keys, App Service settings, connection strings and publishing credentials, AI and machine learning connections and datastores, and Azure Kubernetes Service user credentials.
Compromised applications later accessed SharePoint and OneDrive in affected tenants, including file downloads and mailbox-item access. In some tenants, the threat actor also sent Microsoft Graph API requests, mainly searches for content of interest. Azure activity included enumeration of subscriptions, resource groups, permissions, AI model deployments and service configurations.
The behaviour also showed adaptive troubleshooting. Failed Azure Resource Manager requests were followed by changes to HTTP methods or API versions, after which requests returned HTTP 200 responses. The same pattern appeared when the agent tried to enumerate Key Vault metadata, Azure SQL firewall rules and an Application Insights query endpoint.
The agents also abused OAuth applications. In multiple cases, the same tools obtained a token for a single-tenant OAuth application in the target organisation and then used it to enumerate other cloud resources. Once authenticated, agents searched Azure DevOps for secrets and, in some cases, exfiltrated secrets from Azure Key Vault.
Microsoft also observed use of Run Command, which runs scripts in Azure virtual machines. Access to this function can expose stored credentials, associated workload identities and data on the virtual machine. The activity repeatedly focused on credentials that provide access to AI services, including API keys for major AI service providers and OAuth applications with access to Foundry Tools, previously known as Azure Cognitive Services.
Containment and investigation
Microsoft’s containment guidance starts with repository and credential hygiene. Organisations should scan code in GitHub, remove secrets from the code base, and immediately rotate exposed keys and credentials. GitHub scans public repositories for secrets, and organisations can enable public monitoring to detect leaked secrets in secondary public repositories across GitHub.
For Azure DevOps, GitHub Advanced Security for Azure DevOps can scan for credentials and other sensitive content in source code. Push protection can block supported secrets before they are pushed. Organisations need either GitHub Advanced Security for Azure DevOps or GitHub Secret Protection for Azure DevOps for the standalone experience.
Microsoft’s incident guidance includes blocking 199.19.77[.]84/32 as a named location in Conditional Access for workload identities and in a user-scoped block policy. Workload identity policies require Workload ID Premium licensing and cover only single-tenant apps registered in the tenant. Microsoft advises blocking the exact IP address rather than the whole autonomous system number.
For affected users, Microsoft recommends revoking Entra sessions, Azure DevOps personal access tokens and SSH keys. For affected applications, organisations should remove client secrets, certificates and federated credentials, including any added by the threat actor, and disable the service principal if needed. Already issued tokens remain valid until expiry.
Investigation should cover Entra service principal and non-interactive sign-in logs for 199.19.77[.]84 and 199.19.77[.]18, including failed attempts. Errors AADSTS7000215 and AADSTS7000222 indicate that someone holds a credential for the application. A failure followed by a success needs urgent review.
Microsoft also advises reviewing Azure Activity, Key Vault and Storage diagnostics, Entra audit logs, Azure DevOps audit logs and Microsoft 365 unified audit logs. Useful behaviour-based indicators include one address authenticating to three or more service principals with mixed success, or one application requesting tokens across Azure Resource Manager, Key Vault, Storage and Graph in a short period.
Defensive controls for agentic attacks
The reported activity shows why simple network blocking has limits. Threat actors can change source IP addresses, user agent strings and other tool fingerprints. Agentic frameworks can also retry variations quickly and move to later-stage actions without waiting for an operator.
Microsoft said ARTEX and similar frameworks can use existing penetration testing tools, including Nmap, curl, wget, Python HTTP clients, Norma SDK WebFetch and headless Chromium through Playwright. These tools may leave distinctive network signals, but blocking those signals alone will not stop an agent that can change tactics.
The broader mitigation is to reduce reliance on long-lived secrets. Microsoft recommends moving OAuth applications away from secret-based authentication where possible. Managed identities remove the need to store long-lived application client secrets in code.
Least privilege also applies to workload identities. Security teams should review Azure role-based access control permissions assigned to service principals and restrict them to the resources and operations required by the application. They should also catalogue cloud applications, identify unmanaged apps and limit who can create applications in the tenant.
Microsoft also points to deception controls. Honeypots, decoys, tarpits and fake wins can draw autonomous attacks away from legitimate assets or consume the agent’s time and budget. Microsoft Sentinel Deception is one example named in the guidance.
When exposed GitHub secrets let an autonomous framework reach Entra ID, Key Vault and Microsoft 365 data within minutes, ECS's Security topic deals with the identity controls, Sentinel, Purview and DevSecOps work needed to respond. Sessions and workshops give attendees room to compare detection patterns, workload identity policy, secret scanning and recovery practice with people who run these controls in production. Bring the service principal, Key Vault and Azure DevOps questions that are hard to settle from documentation alone.
This article was written by the ECS editorial team with the assistance of Amal Agent, run.events' AI assistant, which supported the research, drafting and proofreading.