Agentic AI Is Hunting Exposed Secrets: What Microsoft Reported

What happened

Microsoft's post says threat actors used an agentic framework (Microsoft names ARTEX) to send large volumes of GitHub queries for secrets. Those queries often included a target organization name plus keywords tied to secrets, cloud services, or other AI providers. Microsoft writes that historically this kind of hunting was limited by how long it took people to find repos, review them, and act. Agentic tooling shortens that loop by scanning across repositories and then driving follow-on actions.

Microsoft also describes follow-on activity that begins as early as October 28, 2026. In that activity, valid leaked or stolen application credentials were used for service principal sign-ins against Microsoft Entra ID tenants, including cases where a multitenant application credential was compromised at a vendor-owned application and then used across downstream tenants. Observed follow-on work included cloud resource discovery and credential and data exfiltration from Azure Key Vaults and Storage Accounts, plus abuse of Azure AI services. Microsoft also notes reconnaissance against AI workloads deployed on Azure AI services, and interest in credentials that unlock AI services themselves.

One detail that should stick with operators: Microsoft describes sequences that look like adaptive troubleshooting. Failed Azure Resource Manager requests that used the wrong API version were followed, within about a minute, by retries that changed the API version and then succeeded. That is the kind of rapid retry loop humans do slowly and agents do at machine speed.

Microsoft is clear that publicly exposed credentials remain usable until they are revoked or rotated. Editing or deleting the original disclosure does not remediate the exposure. Copies can live in edit history, caches, archives, and logs.

Who should care

This is not only a story for large Azure estates. Any small or mid-size firm that stores cloud keys, SaaS tokens, or AI API keys in GitHub (or in code that later ends up public) is in the same blast radius. Agencies and product teams that ship client work from shared repos are especially exposed if a secret lands in a public fork, a mistaken push, or a leftover config file.

It also matters if you run AI features that depend on long-lived provider keys. Microsoft observed agents focusing on credentials for major AI service providers and on OAuth applications with access to Foundry Tools (previously Azure Cognitive Services). Stolen AI keys can fund the same agentic workflows that found them.

What to do

1. Scan for secrets now. Microsoft encourages organizations to scan code in GitHub for secrets and to enable public monitoring so leaks outside owned repositories still surface. Use your platform's secret scanning and push protection where you have them.
2. Rotate anything that was ever exposed. Treat a public secret as compromised even if the file was later cleaned up. Revoke or rotate the credential, then investigate where it was used.
3. Stop putting long-lived secrets in source. Prefer managed identities and short-lived credentials. Microsoft specifically recommends migrating OAuth applications away from secret-based authentication where possible.
4. Tighten workload identity privilege. Review what each service principal or app can reach. Least privilege limits how far an automated follow-on attack can go after one leaked secret.
5. Watch for agent-like behavior in logs. Microsoft points to high request variety in a short window, rapid retries after failures, and distinctive tooling fingerprints. Those signals can alert you even when source IPs change.

Why this matters for NTx clients

AI agents are no longer only a productivity pitch. The same class of tooling that helps teams automate work can help attackers automate credential hunting and cloud follow-through. That is part of the exposure review in our AI Consulting work: where keys live, who can install agent tools, and what happens when a secret leaks.

It is also a close cousin of WordPress supply-chain risk. A leaked cloud key is like a trusted plugin gone wrong. Both run with access you already granted. Related reading: our notes on the malicious Claude Code extension and AI security and regulation.

FAQ

Is this just another GitHub secret-scanning story?

Partly. Hunting public repos for leaked keys is an old technique. Microsoft's point is that agentic frameworks can scan, analyze, and start follow-on cloud activity much faster, with less hands-on-keyboard work for the attacker.

Did Microsoft say how fast a compromise can move?

Yes. Microsoft wrote that in at least one case an AI agent progressed from searching GitHub for client secrets to exfiltrating data from Azure Key Vault in five minutes.

If we deleted the file that had the key, are we safe?

No. Microsoft states that publicly exposed credentials remain usable until revoked or rotated, and that removing the original disclosure alone does not remediate the exposure.

What should a small business do first this week?

Scan public and private repos for secrets, rotate anything that looks exposed, turn on secret scanning and push protection where available, and stop committing long-lived API keys or OAuth client secrets into code.

How does this relate to AI readiness for a firm?

AI readiness is not only picking a chatbot. It includes how staff get AI tools, where provider keys are stored, and how you respond when a credential leaks. That is the same conversation we start on the AI Consulting page.

Sources

1. Microsoft Threat Intelligence and Microsoft Security Research, "Threat actors use agentic AI tooling to find and abuse exposed secrets," Microsoft Security Blog, November 5, 2026. https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/