MicrosoftMicrosoft Threat Intelligence and Microsoft Security Research
Microsoft tracks AI agents abusing exposed secrets in Azure
Microsoft Threat Intelligence has tracked threat actors employing an agentic AI offensive framework to scan public GitHub repositories for exposed secrets—credentials, application credentials and AI inference API keys—across multiple cloud services. The actors use tools such as ARTEX to scour repositories rapidly, analyse outputs and drive follow-on attacks with minimal hands-on-keyboard interaction.
In one observed case, an AI agent progressed from searching GitHub for secrets to exfiltrating data from Azure Key Vault in five minutes. The activity extends beyond discovery to credential abuse, including use of valid application credentials to access Entra ID tenants and linked Azure resources, with evidence of cloud resource discovery, credential and data exfiltration from Key Vaults and Storage Accounts, and abuse of Azure AI services.
Microsoft reports follow-on activity beginning as early as 28 October 2026, where service principal sign-ins occurred from IPs 199.19.77[.]84 and 199.19.77[.]18 (the latter a Tor exit node), targeting multiple tenants and applications. The attackers attempted to read storage keys, App Service settings, connection strings and other secrets, enumerated subscriptions and resources, and accessed SharePoint and OneDrive.
Replays of API requests showed adaptive behaviour: ARM API calls to enumerate secret metadata shifted from data-plane to control-plane API versions (for example, targeting Key Vault with API version 2023-07-01 to obtain HTTP 200 responses after initial 400 errors). OAuth applications were compromised to enumerate further resources and potentially exfiltrate secrets, including via Run Command on Azure VMs.
Microsoft notes that some activity involved OAuth scopes aimed at AI services, and that in at least one case the AI agent moved from code-search to Key Vault exfiltration within five minutes. Evidence also ties some actions to two attacker IPs, with reconnaissance targeting AI workloads on Azure AI services.
Mitigations focus on containing credential exposure and improving detection: revoke or rotate exposed credentials, block the identified IPs in conditional access policies, review service principal and non-interactive sign-ins, enable auditing across Azure DevOps, Key Vault, Storage and Graph, and enforce least privilege for workload identities.
Organisations are urged to protect secrets stored outside code, use managed identities where possible, and deploy Defender for Cloud protections, including Defender for Key Vault and Defender for Resource Manager. Defences also include detection of rapid, varied requests typical of agentic AI scanning, deploying honeypots or decoys, and leveraging Security Copilot for incident response.