Microsoft Says an AI Hacking Agent Went From a GitHub Leak to Key Vault Data in Five Minutes
Microsoft says an AI agent built on the ARTEX framework went from scanning GitHub for a leaked secret to exfiltrating Azure Key Vault data in five minutes, and that deleting the leaked file does not fix anything.
Five minutes. That is how long Microsoft says it took one AI agent to go from searching GitHub for a leaked client secret to pulling data out of a victim's Azure Key Vault. No human had to read the results or test the key.
The figure comes from a Microsoft Threat Intelligence report published November 5. Microsoft says threat actors have been using ARTEX, an agentic offensive security framework, to hunt public repositories for credentials, OAuth application secrets and API keys for AI services, then to use whatever they find inside the victim's own cloud.
The site has already covered ARTEX in a very different campaign, the ConnectWise breach Microsoft pinned on a China-aligned group. This one has no named actor. Microsoft does not attribute it to any group or country, and that absence is part of the story.
Secret scanning on GitHub is an old trick. Microsoft's point is that it used to be slow, because a person had to find the repositories, read the files and work out what each key could open. Starting in August 2026, Microsoft says, the framework fired large volumes of GitHub queries that often paired a target organization's name with words for secrets, cloud services or another AI provider.
"In at least one case, Microsoft observed an AI agent advance from scanning GitHub for secrets to exfiltrating data from Azure Key Vault in just five minutes." Microsoft Threat Intelligence
An agent that fixes its own mistakes
The most unsettling detail in the report is not the speed. It is the debugging. Microsoft describes the agent sending a batch of Key Vault requests with the wrong API version, getting HTTP 400 errors back, and rerunning the same requests with a working version about 28 seconds later. It pulled the same trick on Azure SQL and Application Insights calls within about 60 and 80 seconds. Microsoft calls it "adaptive troubleshooting." That is software reading its own error messages and correcting course.
Once inside, Microsoft says, the agents grabbed tokens for OAuth applications, mapped subscriptions and AI model deployments, searched Azure DevOps for more secrets and used Run Command to execute scripts on Azure virtual machines. They also showed a clear appetite for keys to AI services.
A second thread makes this a supply chain problem. As early as October 28, Microsoft says it saw successful service principal sign-ins from a single IP address across multiple application IDs, including multitenant app credentials compromised at the vendor and then used to reach downstream customer tenants. App sign-ins like these trigger no MFA prompt, and as Todyl puts it, if the credential is valid, the app is in.
Security firm Todyl, which Microsoft cites as reporting a similar campaign from the same IPs, says it first saw the activity on November 1 and counts 27 organizations reached, including managed service providers and their clients, with 81 files downloaded and about 2,279 mailbox items accessed. Todyl says one partner was billed thousands of dollars in AI API usage in about 10 minutes.
Microsoft's fix list is blunt, and its first point is the one most worth tattooing on a developer's hand. Deleting the file from GitHub does nothing on its own.
"Publicly exposed credentials remain usable until revoked or rotated; removing the original disclosure alone does not remediate the exposure." Microsoft Threat Intelligence
The company says any secret found in a public repository should be treated as compromised, rotated immediately and investigated for past use. It wants developers to move OAuth apps off long-lived client secrets and onto managed identities, which keep credentials out of code entirely. It also suggests decoys, tarpits and "fake wins" that convince an attacking agent its job is done, which Microsoft says cut attack traffic reaching real assets in its testing.
That last idea is the most interesting thing in the report. If the attacker is a piece of software that never gets bored, the defense may be to bore it, or simply lie to it. Meanwhile, the old rule holds with a shorter clock. A secret pushed to a public repo is not a mistake you have days to fix. On Microsoft's evidence, you may have minutes.
