# Microsoft warns hackers use agentic AI to find GitHub secrets and breach Azure

Digest AI · Policy & Regulation · published 2026-11-05T15:46:00Z · updated 2026-11-05T22:40:00Z

Canonical: https://digestai.news/story/microsoft-observes-threat-actors-using-agentic-ai-to-find-exposed-secr

## Summary

Microsoft's Threat Intelligence unit reported that attackers are using agentic AI frameworks to scan public GitHub repositories for exposed passwords, API keys, and application credentials, then using them to breach cloud systems. The activity began in August 2026 and involved a framework called ARTEX. In one incident, an AI agent moved from searching GitHub to stealing data from an Azure Key Vault in five minutes. Attackers used IP address 199.19.77.84 and multiple application IDs across several customers, and in some cases compromised multitenant vendor applications to access multiple environments. The AI tools also searched cloud resources, accessed Azure Key Vaults and Storage Accounts, downloaded files from SharePoint and OneDrive, and targeted AI and machine learning services. Microsoft advises treating every publicly exposed credential as compromised, immediately revoking or rotating affected secrets, reviewing Entra ID sign-in records, Azure activity logs, and Key Vault access logs, avoiding long-term secrets in code, using managed identities, enabling GitHub secret scanning, and deploying honeypots.

## Key points

- Attackers use agentic AI framework ARTEX to scan GitHub for exposed credentials
- AI agent breached Azure Key Vault in five minutes from initial GitHub scan
- Compromised multitenant applications gave access to multiple customer environments

## Why it matters

Agentic AI automates credential theft and lateral movement at speed, turning exposed GitHub secrets into rapid cloud breaches across multiple tenants.

## Sources

1. [Hackers turn to agentic AI to find exposed secrets on GitHub, warns Microsoft](https://digit.in/news/general/hackers-turn-to-agentic-ai-to-find-exposed-secrets-on-github-warns-microsoft.html) (digit.in, 2026-11-05)
2. [Threat actors use agentic AI tooling to find and abuse exposed secrets](https://microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets) (microsoft.com, 2026-11-05, primary source)

## Cite

Digest AI, "Microsoft warns hackers use agentic AI to find GitHub secrets and breach Azure", 5 November 2026, https://digestai.news/story/microsoft-observes-threat-actors-using-agentic-ai-to-find-exposed-secr

---

Written by Digest AI's editorial model from the linked sources; the sources are the record. Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse
JSON: https://digestai.news/story/microsoft-observes-threat-actors-using-agentic-ai-to-find-exposed-secr.json