Microsoft says AI agents are searching GitHub for leaked secrets and using them within minutes

Microsoft Threat Intelligence reported on November 5, 2026 that threat actors are using an agentic AI offensive framework to find and use secrets exposed in public GitHub repositories, and it names ARTEX as an example of this kind of tooling. Microsoft says that starting in August 2026 the framework sent large volumes of queries to GitHub for secrets, and that the queries often included the name of a target organization, keywords for secrets, a keyword linked to cloud services, or a keyword linked to another AI service provider. The secrets it looked for included credentials, application credentials and AI inference-related API keys across multiple applications and cloud services.

Microsoft says searching public code for keys is an old technique that used to be limited by how long it took a person to find repositories, read them and act on what they found. With agentic tooling the agent does the searching, reads the results and runs the follow-on attack itself. In at least one case, Microsoft says, an AI agent went from searching GitHub for client secrets to taking data from Azure Key Vault in five minutes.

What the agents did with the secrets

Microsoft says that from as early as October 28, 2026 it saw successful sign-ins as dozens of applications across multiple tenants, using leaked or stolen application credentials. In some cases a vendor's multitenant application credential was compromised at the source and used to reach that vendor's downstream tenants. In that attack, Microsoft says, the threat actor mapped the environment and went after operations that return more credentials, and the compromised applications downloaded files from SharePoint and OneDrive. Microsoft also says that in multiple cases the same agentic AI tools subsequently obtained a token for a single-tenant OAuth application in the same target organization and used the compromised application to find other cloud resources. In some cases, the agents took secrets from Azure Key Vault. The agents also searched Azure DevOps for secrets after authenticating and used the compromised OAuth application to run scripts on Azure virtual machines through Run Command.

Microsoft says the agents repeatedly focused on credentials that give access to AI services, such as API keys for major AI service providers. It also reports request sequences consistent with adaptive troubleshooting: one batch of requests for Key Vault secret metadata failed, and about 28 seconds after the first failed response a rerun began with a corrected API version and succeeded.

What Microsoft recommends

Microsoft says organizations that find their secrets in public repositories must assume the secrets and the applications behind them are compromised. It says a publicly exposed credential remains usable until it is revoked or rotated, and that removing the original disclosure does not fix it, because copies can survive in edit history, caches, archives, logs and other systems. Its advice is to scan your code for secrets, rotate anything exposed immediately and investigate how it was used, use GitHub secret scanning and push protection to block supported secrets before they are pushed, give application identities only the permissions they need, and move away from long-lived secrets where the platform allows it.

Our advice, not Microsoft's: if a Supabase service-role key, a Stripe secret key or an AI provider key was exposed, rotate it in the provider's dashboard, then check that provider's usage or logs for activity you do not recognize. For AI provider keys, set a spending limit where the provider offers one, so a leaked key can cost you less. Our guide to keys committed to GitHub covers the rotation steps.