ARTEX: AI agents go from GitHub secrets to Key Vault

What Microsoft saw

In an analysis published November 5, Microsoft Threat Intelligence says attackers have been using agentic AI tooling since August 2026 to send large volumes of secret searches to GitHub. Queries typically combine a target organization's name, secret-related keywords and cloud or AI provider keywords. Microsoft cites ARTEX, an open-source offensive framework, as an example.

An old technique got a new pace. Hunting for leaked keys used to be slow because a human had to review the repos. An agent analyzes the hits itself and moves straight to the next step. In one case Microsoft measured five minutes from a client secret found on GitHub to data leaving Azure Key Vault.

What the agent did once inside

From October 28, Microsoft saw successful service principal sign-ins at several customers from 199.19.77.84, using leaked but still valid application credentials. In some cases a vendor's multitenant app credential was compromised at the source, opening a path into several downstream tenants.

Once signed in, the agent went after operations that return more credentials: storage account keys, App Service settings, connection strings and AKS user credentials. It read Key Vault secrets, downloaded SharePoint and OneDrive files, searched through Graph and looked for secrets in Azure DevOps. It also used Run Command to execute scripts on Azure VMs.

One detail stands out: adaptive troubleshooting. When an ARM call returned HTTP 400 because of a wrong API version, the agent retried 28 to 80 seconds later with a corrected version and got a 200. That is machine speed, not a human at a keyboard. The agent also focused on API keys for AI providers, which Microsoft says it may have used to run more of its own workload on stolen AI resources.

VulnCheck's canaries caught the same IP through a different door, exploiting Langflow to pull credentials straight off the server (VulnCheck).

What to do now

• Treat anything that ever reached a public repo as compromised. Deleting the commit is not enough; rotate the key.
• Turn on GitHub secret scanning and push protection, and extend public monitoring to repos outside your organization.
• Use managed identities instead of client secrets wherever possible.
• In Entra sign-in logs, errors AADSTS7000215 and AADSTS7000222 mean someone holds an old credential for your app. A failure followed by a success is urgent.
• Alert on behavior too: one IP trying three or more service principals with mixed success.

Microsoft says decoys, tarpits and fake wins work well against autonomous attackers, because the agent believes it is done and stops. The full post includes KQL hunting queries and indicators (Microsoft Security Blog).

Why it matters

This is the mirror image of the defensive side. We covered how OpenAI's AI pipeline found 948 Linux root exploits (OpenAI's AI pipeline found 948 Linux root exploits). Now the same acceleration shows up on the attacker's side. If a key gets you to Key Vault in five minutes, a weekly secret scan is too slow: you need push protection and short-lived credentials.