Microsoft Threat Intelligence and Microsoft Security Research reported on November 5 that threat actors are using an agentic artificial intelligence framework called ARTEX to search public GitHub repositories for exposed credentials, application secrets, and AI inference keys, and then to use those secrets to move into victims' cloud environments. In one documented case, Microsoft says, an agent went from scanning GitHub for client secrets to exfiltrating data from Azure Key Vault in five minutes.
Microsoft says it first observed the repository scanning in August 2026. The agents submitted large volumes of GitHub queries that paired a target organization's name with keywords for secrets, cloud services, and AI service providers. ARTEX is an offensive framework with roots in penetration testing, the authorized practice of probing an environment for weaknesses. In the attackers' hands, the same automation interprets search results, validates what it finds, and selects the next step without a human operator working at a keyboard throughout the attack.
Once an agent found a usable client secret, it signed in as that application's service principal, the identity an application uses to authenticate to Microsoft Entra ID, and enumerated resources through Azure Resource Manager. Microsoft observed the agents extracting Azure Key Vault secrets, reading storage accounts, enumerating App Service, Azure Kubernetes Service, Azure SQL, and Application Insights, searching Azure DevOps for further secrets, and running commands on virtual machines through the legitimate Run Command feature. Compromised applications also reached SharePoint and OneDrive, with file downloads and mailbox items accessed.
The detail that should concern cloud defenders most is the self-correction. When one batch of Key Vault requests failed with an HTTP 400 error because it mixed a data-plane API version with a control-plane endpoint, the agent retried about 28 seconds later with a supported version and succeeded. Microsoft describes similar corrections after failed Azure SQL and Application Insights requests, with retries arriving at machine tempo, roughly 28 to 80 seconds after a failure. That behavior compresses the window in which a defender can notice and interrupt an intrusion in progress.
The follow-on campaign widened the blast radius. Beginning as early as October 28, Microsoft saw successful service-principal sign-ins across dozens of applications in multiple tenants, in some cases using credentials belonging to vendor-owned multitenant applications. That pattern puts downstream customers of managed service providers and software vendors at risk from a secret they never committed themselves. Microsoft says the activity overlaps with a campaign described this week by security firm Todyl that used the same source address against Entra ID environments. It is not yet clear who is behind the GitHub scanning. Separately, Censys reported counting more than 1,400 internet-exposed ARTEX consoles in early November, a reminder that the tooling itself is widely deployed.
Microsoft's guidance is blunt: an organization that finds its secrets exposed in a public repository should assume both the credentials and the associated applications are compromised. Responders should revoke or rotate affected secrets, replace credentials stored in any Key Vault the compromised application could read, and consider disabling the affected service principals, noting that already-issued tokens remain valid until they expire. Longer term, Microsoft recommends reducing reliance on long-lived secrets through managed identities, enforcing least privilege, and turning on GitHub secret scanning and push protection. A leaked secret has always been an emergency. Agents that can act on one in five minutes have removed whatever grace period defenders once assumed they had.