AI Agents Stole Cloud Keys in Five Minutes, Microsoft Says
Microsoft says an AI agent went from scanning public GitHub for leaked secrets to copying data from an Azure Key Vault in five minutes. The company links the attacks to an agentic framework called ARTEX.
In just five minutes, an AI agent went from scanning public GitHub for leaked secrets to copying data out of an Azure Key Vault, Microsoft Threat Intelligence said. The company has watched threat actors use an agentic AI offensive framework called ARTEX to hunt credentials, application logins and AI API keys left on the public code-sharing site, then use them against Azure and Microsoft Entra.
Microsoft set out the findings in a 5 November report. Key Vault is the service where cloud apps store passwords and keys. Hunting leftover passwords in public code used to wait on a person to find, read and try each secret. ARTEX lets attackers scan faster and have the agent run the next steps without someone at the keyboard for each one.
From a GitHub scan to a Key Vault
Microsoft said the actors began sending large volumes of GitHub queries for secrets as early as August 2026, often naming a target organisation plus keywords for secrets, cloud services or another AI provider.
Follow-on sign-ins from 28 October
From about 28 October 2026, Microsoft saw successful service principal sign-ins — the login identity an app uses in the cloud — from the IP address 199.19.77.84, and related addresses, using leaked but still-valid application credentials across multiple tenants. In some cases a vendor-owned multitenant application credential was compromised at the source and used to reach downstream customers. The actors used those logins to map cloud resources, steal more credentials and data from Key Vaults and Storage Accounts, and abuse Azure AI services.
Deleting the secret is not enough
Microsoft said organisations should scan their GitHub code for secrets and treat anything found there as already compromised. Taking a secret out of a repository does not fix the problem, because the credential stays usable until it is revoked or rotated. The company recommends moving applications away from long-lived client secrets stored in code and using managed identities instead.
GitHub automatically scans public repositories for secrets, and organisations can turn on public monitoring to catch leaks beyond those they own. Microsoft also points defenders to GitHub Advanced Security for Azure DevOps and Microsoft Defender for Cloud recommendations.
This campaign differs from the recent case in which stolen AI API keys ran up $1 million in bills, according to Google. Here the leaked secrets were used as a doorway into Azure itself.
Why it matters
Agentic tooling now compresses a once-manual hunt for leaked cloud credentials into minutes, and a secret left in a public repository remains a live key until someone rotates it. Teams that still store long-lived application secrets in code are exposed to that speed, even after they delete the offending file.
