{"version":1,"type":"story","url":"https://digestai.news/story/microsoft-observes-threat-actors-using-agentic-ai-to-find-exposed-secr","json":"https://digestai.news/story/microsoft-observes-threat-actors-using-agentic-ai-to-find-exposed-secr.json","markdown":"https://digestai.news/story/microsoft-observes-threat-actors-using-agentic-ai-to-find-exposed-secr.md","slug":"microsoft-observes-threat-actors-using-agentic-ai-to-find-exposed-secr","headline":"Microsoft warns hackers use agentic AI to find GitHub secrets and breach Azure","summary":"Microsoft's Threat Intelligence unit reported that attackers are using agentic AI frameworks to scan public GitHub repositories for exposed passwords, API keys, and application credentials, then using them to breach cloud systems. The activity began in August 2026 and involved a framework called ARTEX. In one incident, an AI agent moved from searching GitHub to stealing data from an Azure Key Vault in five minutes. Attackers used IP address 199.19.77.84 and multiple application IDs across several customers, and in some cases compromised multitenant vendor applications to access multiple environments. The AI tools also searched cloud resources, accessed Azure Key Vaults and Storage Accounts, downloaded files from SharePoint and OneDrive, and targeted AI and machine learning services. Microsoft advises treating every publicly exposed credential as compromised, immediately revoking or rotating affected secrets, reviewing Entra ID sign-in records, Azure activity logs, and Key Vault access logs, avoiding long-term secrets in code, using managed identities, enabling GitHub secret scanning, and deploying honeypots.","keyPoints":["Attackers use agentic AI framework ARTEX to scan GitHub for exposed credentials","AI agent breached Azure Key Vault in five minutes from initial GitHub scan","Compromised multitenant applications gave access to multiple customer environments"],"whyItMatters":"Agentic AI automates credential theft and lateral movement at speed, turning exposed GitHub secrets into rapid cloud breaches across multiple tenants.","category":{"slug":"policy","name":"Policy & Regulation","url":"https://digestai.news/category/policy"},"entities":{"companies":["Microsoft","GitHub","Azure"],"models":["ARTEX"],"people":[]},"firstPublishedAt":"2026-11-05T15:46:00Z","updatedAt":"2026-11-05T22:40:00Z","sourceCount":2,"hasPrimarySource":true,"sources":[{"outlet":"digit.in","title":"Hackers turn to agentic AI to find exposed secrets on GitHub, warns Microsoft","url":"https://digit.in/news/general/hackers-turn-to-agentic-ai-to-find-exposed-secrets-on-github-warns-microsoft.html","publishedAt":"2026-11-05T22:40:00Z","type":"press","primary":false,"lead":true},{"outlet":"microsoft.com","title":"Threat actors use agentic AI tooling to find and abuse exposed secrets","url":"https://microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets","publishedAt":"2026-11-05T15:46:00Z","type":"primary","primary":true,"lead":false}],"sourceNotes":null,"discussions":[],"thread":null,"cite":{"text":"Digest AI, \"Microsoft warns hackers use agentic AI to find GitHub secrets and breach Azure\", 5 November 2026, https://digestai.news/story/microsoft-observes-threat-actors-using-agentic-ai-to-find-exposed-secr","publisher":"Digest AI","title":"Microsoft warns hackers use agentic AI to find GitHub secrets and breach Azure","datePublished":"2026-11-05T15:46:00Z","url":"https://digestai.news/story/microsoft-observes-threat-actors-using-agentic-ai-to-find-exposed-secr"},"generatedBy":"Written by Digest AI's editorial model from the linked sources; the sources are the record.","license":"Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse"}