AI agent breaches corporate cloud in five minutes using secrets leaked on GitHub

What's going on

In early November 2026, Microsoft's security research team, Microsoft Threat Intelligence, warned of a new attack technique: criminals are deploying AI agents (AI programs that independently plan and carry out several steps in a row) to scour public code on GitHub for accidentally uploaded passwords, app credentials and API keys. API keys are essentially digital house keys that programs use to identify themselves to a service. The agents then use the keys they find to break straight into the affected companies' cloud environments.

According to Microsoft, the tool in question is called ARTEX, a so-called agentic attack framework. Microsoft says it first observed the activity in August 2026. The most striking case: an agent needed just five minutes to go from its first GitHub search to pulling data out of a company's Azure Key Vault, a digital vault where companies store their most important keys and passwords.

Old technique, new speed

Combing public code repositories (project folders on GitHub) for forgotten credentials isn't a new trick. What's new, according to Microsoft, is the speed. Until now, these attacks were slowed down by the fact that humans had to find the right projects, sift through their contents and try out the keys they found. ARTEX, by contrast, fires off huge numbers of search queries at GitHub, usually combining the target company's name with terms related to credentials, cloud services and AI providers. The agent then evaluates the results itself and launches the next stages of the attack on its own.

"Agentic tools like ARTEX not only allow attackers to search for secrets faster across many repositories, but also let the agents analyze the results and carry out follow-on attacks, meaning the attacker barely has to lift a finger across the entire attack chain."

According to Microsoft, app secrets and API keys for AI inference were especially sought after. These are keys that let you use paid AI models in the cloud.

Trade outlet Homeland411 describes additional details from the forensic evidence: for its searches, the agent reportedly used a remote-controlled browser (Playwright with "headless" Chromium, meaning no visible window) as well as the official GitHub API. The agent determined whether a key it found was valid based on specific error codes from Microsoft's sign-in system. Notably, when the agent received error messages ("HTTP 400 Bad Request") while querying the Azure management API, it analyzed them itself and switched its requests to a supported API version within about 30 seconds. It's a kind of automatic self-repair that a human would previously have had to handle.

What the attackers did inside the clouds

Microsoft also investigated the follow-on attacks via Microsoft Entra ID, the identity system that users and programs use to sign in to Microsoft's cloud. As early as October 28, the company recorded successful sign-ins by service principals (technical accounts that applications, rather than people, use to sign in) from the IP address 199.19.77.84, across multiple applications and affected customer environments. Homeland411 also reports that some of the access ran through a Tor node, i.e. an anonymization network.

Particularly concerning: in some cases, credentials for a multi-tenant application (an app a vendor provides to many customer companies at once) were compromised directly at the vendor. With that single key, the attackers then got into multiple downstream customer environments.

Using this access, the attackers mapped out the cloud environments: they enumerated subscriptions, resource groups, permissions and deployed AI models, and siphoned off sensitive data. Their targets included:

• Azure Key Vaults
• Storage accounts (cloud storage)
• App Service settings and database connection strings
• Credentials for Kubernetes (a platform for running many programs on servers)
• Connections to AI and machine learning services

The compromised applications also accessed SharePoint and OneDrive, downloaded files and read mailbox contents. Microsoft also observed attempts to abuse Azure AI services and to search Azure DevOps for further exposed secrets. In some cases, the agents signed in through hijacked OAuth applications (OAuth is a widely used method for granting apps access to accounts) before emptying key vaults. Using the Azure "Run Command" feature, they even executed scripts on virtual machines, which can open the way to further unprotected credentials and data.

According to Microsoft, further suspicious activity came from the addresses 65.87.223.26 (signs of vulnerability exploitation and attempts to steal App Service sign-in tokens) and 157.22.126.128 (reconnaissance of victims' Azure AI workloads).

Deleting isn't enough

Microsoft's key message to developers: if you've accidentally made a key public, treat it as stolen, even if you remove it from GitHub shortly afterward. Deleting it doesn't invalidate the key, and copies live on in the project's version history, in caches and in other systems.

"Publicly exposed credentials remain usable until they are revoked or rotated; removing the original post alone does not fix the problem."

Microsoft therefore recommends that you:

• immediately revoke or rotate (replace) affected credentials and check what they've been used for in the past,
• give technical accounts only the minimum permissions they need (least privilege),
• never store long-lived secrets in source code,
• migrate OAuth applications to Managed Identities, where the cloud manages the identity itself and no password needs to live in the code,
• enable GitHub Secret Scanning and Push Protection, which flag detected keys or block them from being uploaded in the first place,
• turn on the relevant protections in Microsoft Defender for Cloud.

How to lure AI agents into a trap

Autonomous attacks are hard to detect because, according to Microsoft, the agents can switch IP addresses, their program identifier (user agent) and other characteristics in a flash. Defenders should therefore watch for unusual patterns, such as very rapid sequences of API requests and repeated sign-in attempts.

Deception techniques come on top of that: honeypots (deliberately planted decoy systems), dummies and tarpits, which artificially slow down requests and cost the agents time and compute budget. According to Homeland411, Microsoft engineers showed in lab experiments that such decoys do in fact divert agents to fake targets; planted fake keys also triggered an immediate, reliable alert as soon as an agent tried them. The outlet also mentions the idea of feeding agents fake success messages so they consider their mission complete prematurely. These details come from the Homeland411 report and could not be verified in the primary source.

Microsoft's conclusion: if AI makes attacks faster and more autonomous, defenders need to use AI too, to investigate large cloud environments and respond quickly.

The bottom line

The report is a concrete example of what security researchers have been warning about for a while: AI agents don't lower the bar for attacks through entirely new tricks, but by drastically speeding up and automating well-known techniques. Five minutes from discovery to data theft leaves practically no room for the classic "Oops, committed a key, better delete it fast" response. If you have credentials in your code, assume they'll be found within minutes.

Those most at risk are companies whose developers put keys directly in code, and software vendors with multi-tenant apps, where a single leak can hit many customers. It's also telling that attackers are specifically hunting for API keys for AI services: they're worth real money, because attackers can use them to run expensive models on someone else's dime.

Who's behind ARTEX, how many organizations are affected and which AI model powers the framework remain open questions; the primary source doesn't say. It's also worth keeping in mind that Microsoft is both a cloud provider and the seller of the recommended security products, such as Defender for Cloud. The core advice, though (rotate keys, no secrets in code, minimal permissions), applies regardless of vendor and has been proven practice for years. What's new is mainly that lapses now get punished much faster.