The Pulse

Microsoft Finds AI Agents Turning GitHub Secrets Into Azure Access

Threat actors used agentic AI tooling to find exposed credentials on GitHub and access cloud resources, Microsoft says. In one case, an agent moved from searching for secrets to exfiltrating Azure Key Vault data in five minutes.

AI.info Team · Written with AI · fact-checked · 2026-11-06

An AI agent moved from searching GitHub for client secrets to exfiltrating data from Azure Key Vault in five minutes, Microsoft says. The company also describes cloud API requests that failed, then succeeded after agents changed methods or API versions. Attackers can alter the network fingerprints left by their tools, Microsoft says, and it advises defenders to look for behavioral signals.

ARTEX searched public GitHub repositories

Starting in August 2026, Microsoft observed threat actors using an agentic framework to send large volumes of queries to GitHub for secrets. The searches could include a target organization’s name alongside keywords for secrets, cloud services or another AI service provider. ARTEX can scan multiple repositories, analyze the results and conduct follow-on attacks with less need for operators to intervene throughout the attack chain, Microsoft says.

The exposed material included credentials, application credentials and API keys related to AI inference across applications and cloud services. Deleting a secret from a public repository does not invalidate it, Microsoft warns: the credential remains usable until it is revoked or rotated.

October sign-ins reached multiple tenants

As early as October 28, 2026, Microsoft observed successful service-principal sign-ins from 199.19.77[.]84 involving multiple application IDs across some affected customers. In some cases, a credential for a multitenant application was compromised at its vendor-owned source and then used to access downstream tenants. The compromised credentials supported cloud-resource discovery, credential and data exfiltration from Azure Key Vaults and Storage Accounts, and activity involving Azure AI services.

Agents also accessed SharePoint and OneDrive in targeted tenants, Microsoft says, including by downloading files and accessing mailbox items. They enumerated Azure subscriptions, resource groups, permissions, AI model deployments and service configurations. The observed activity also included attempts to validate stolen Azure resources, including compromised Azure AI services.

Failed Azure requests turned into successful retries

Microsoft describes an agent’s Azure Resource Manager requests from 199.19.77[.]84 that showed adaptive troubleshooting. A batch of requests to enumerate Azure Key Vault secret metadata returned HTTP 400 because it used a Key Vault data-plane API version against control-plane APIs. About 28 seconds after the first failure, the agent retried the same vault paths using ARM API version 2023-07-01, and the requests returned HTTP 200.

Agents can also search Azure DevOps for secrets after gaining access through a compromised OAuth application, Microsoft says. Exposed credentials can provide a route to persistence, additional identity compromise or resource hijacking until they are revoked or rotated, the company warns.

Microsoft points defenders to behavior, not just fingerprints

The tools can change source IP addresses and user-agent strings, making it difficult to identify malicious traffic through those signals alone, Microsoft says. Its guidance points defenders to the speed and variety of requests, repeated attempts using altered techniques, and quick movement to later attack stages. The company recommends immediately rotating exposed credentials and favoring managed identities, which avoid storing long-lived application secrets in code.

Microsoft also describes honeypots, decoys, tarpits and fake wins as ways to draw autonomous agents away from real targets or consume their time. In its testing, these controls reduced attack traffic reaching real assets and produced what the company described as high-confidence, attribution-quality signal.