AI Agents Now Hunt GitHub for Exposed Secrets and Reach Cloud Data in Minutes

Microsoft Threat Intelligence has observed threat actors using an agentic AI offensive framework to search public GitHub repositories for exposed secrets. These include credentials, application credentials and AI inference-related API keys across multiple applications and cloud services. Searching code repositories for secrets is a well-documented technique, but it has been slowed by the time human operators need to find repositories, review them and use what they find.

Tools like ARTEX remove much of that delay. They scan many repositories faster, analyse the results and carry out follow-on attacks, so the attacker needs less hands-on-keyboard involvement. In at least one case, Microsoft saw an AI agent go from scanning GitHub for secrets to exfiltrating data from Azure Key Vault in just five minutes.

Microsoft also investigated follow-on misuse of valid application credentials. From as early as October 28, 2026, it saw successful service principal sign-ins from IP address 199.19.77[.]84 across multiple application IDs. In some cases, a multitenant application credential owned by a vendor was compromised and used to reach multiple downstream tenants. The actor carried out cloud resource discovery, credential and data theft (including from Azure Key Vaults and Storage Accounts), and abused Azure AI services. Microsoft also linked malicious activity to 65.87.223[.]26, which showed signs of vulnerability exploitation and attempts to obtain App Service authentication tokens, and to 157.22.126[.]128, which performed reconnaissance against AI workloads on Azure AI services. Todyl reported a similar campaign involving the same IP addresses.