Microsoft: AI agents are scanning GitHub for exposed secrets – in one attack they reached Azure Key Vault in five minutes

In at least one case it took an AI agent five minutes to go from searching for secrets on GitHub to extracting data from Azure Key Vault, Azure’s service for safeguarding keys and secrets. The figure appears in an analysis published on Thursday, November 5 by Microsoft Threat Intelligence, the company’s team that tracks cyber threats, and it shows how much an old technique has been accelerated.

Microsoft describes attackers using an offensive framework built on AI agents (agentic AI, meaning software that makes its own decisions and carries out successive steps) to search public GitHub repositories for exposed secrets: user and application credentials and API keys for AI services. Tools such as ARTEX scan many repositories faster, analyse the findings on their own and proceed to follow-on attacks, without the attacker having to be continuously present. The activity has been recorded since August 2026, with queries that often contained the name of the target organisation and keywords for secrets, cloud services or other AI providers.

What the agent did in Azure

Since October 28, 2026, Microsoft has seen successful sign-ins with a “service principal” (the identity through which an application gains access to the resources it is permitted) at its customers. They came mainly from the IP addresses 199.19.77[.]84 and 199.19.77[.]18, the latter being an exit node of the Tor network. In some cases the compromised credential belonged to a vendor’s application and gave access to many of its customers. The agent signed in to dozens of applications across many tenants, looked for storage account keys, App Service settings and Azure Kubernetes Service credentials, and through the applications reached files and mail in SharePoint and OneDrive.

The most notable element is the adaptive behaviour. In a request to Azure Resource Manager for secret metadata across many Key Vaults, the response was HTTP 400, because the Key Vault’s own API version had been declared instead of an Azure Resource Manager version. About 28 seconds later the same batch of requests ran again with version 2023-07-01 and got HTTP 200. Similar corrections were made after about 60 seconds in a request for the firewall rules of an Azure SQL server and after about 80 in a request to Application Insights. In both cases the fix concerned only the API version.

In many cases the agents obtained a token for a single-tenant OAuth application in the same target organisation and used it to enumerate the remaining resources, extract secrets from Key Vault and search Azure DevOps. They also used the Run Command feature, which executes command scripts on Azure virtual machines. They showed steady interest in API keys of major AI providers and in applications with access to Foundry Tools, formerly Azure Cognitive Services. Microsoft also identified 65.87.223[.]26, from which attempts to obtain App Service tokens were made, and 157.22.126[.]128, which carried out reconnaissance on AI workloads. A similar campaign using the same IP addresses had been reported by Todyl.

Microsoft’s recommendations

Microsoft recommends treating any secret that has been publicly exposed as compromised, even if the content is corrected or deleted, and changing it immediately. It also proposes scanning code on GitHub, moving to managed identities instead of long-lived secrets, and blocking 199.19.77[.]84 through Conditional Access policies. It explains that the sign-in errors AADSTS7000215 (invalid secret) and AADSTS7000222 (expired secret) show that someone holds the application’s credential, and that a failed sign-in followed by a successful one calls for an immediate response. An address identified with three or more service principals is also suspicious. Because attackers change IP addresses easily, the company puts the weight on behaviour: many different requests in a short time and progression to the next stage at machine speed. In Microsoft’s tests, honeypots and decoys reduced the hostile traffic reaching real resources.

Microsoft places the activity in a broader trend: attackers are accelerating every stage of the attack with AI agents, and defenders are called on to do the same. The same week the company published its analysis of how vulnerabilities are exploited in practice and figures on the third-quarter wave of phishing.