AI Agents Are Mining GitHub for Your Secrets
What Microsoft's Latest Warning Means for U.S. Organizations
On November 5, Microsoft Threat Intelligence published research showing that attackers are using an agentic AI framework called ARTEX to search public GitHub repositories for exposed secrets, including cloud credentials, application client secrets and API keys for AI services. Searching code for leaked credentials is an old technique, but it used to be limited by how long it took a human to find, read, and act on what turned up. Microsoft says the agents now do all three, and in at least one case an agent went from scanning GitHub to exfiltrating data from an Azure Key Vault in just five minutes.
The scanning began in August 2026, with queries that combined a target organization's name with keywords for secrets, cloud services, and AI providers. ARTEX is a tool normally used for penetration testing, and it has turned up in a widening range of campaigns, including espionage that CrowdStrike attributes to a group it calls VAPOR PANDA and financially motivated attacks against banks that Microsoft described in a follow-up report on November 6.
From a Leaked Key to a Cloud Breach
Microsoft's investigation tied the GitHub scanning to a wave of sign-ins that began on October 28, in which an agent used valid application credentials to authenticate to Microsoft Entra ID as service principals, the identities software uses to reach cloud resources without a person present. Once inside, the agent went after anything that returns more credentials, including storage account keys, connection strings, App Service settings, and Kubernetes credentials. Then it downloaded files from SharePoint and OneDrive and searched mailboxes through Microsoft Graph.
Managed service providers were hit especially hard. Security firm Todyl reported the same infrastructure signing in to 33 of 45 targeted app registrations. Cybersecurity Dive reported that the attacker reached 27 organizations, including downstream clients in energy, government, food and agriculture, transportation, and construction. In some cases a single compromised multitenant application owned by a vendor became a key to many customer tenants at once.
The agents also adapted on the fly. When an Azure API call failed because of an outdated version parameter, the agent corrected it and retried within seconds to a minute; behavior Microsoft describes as adaptive troubleshooting. That speed is the real change here: a secret that once might have sat unnoticed for weeks can now be found, tested and abused before a security team sees the first alert.
Why This Matters for Your Organization
Many U.S. businesses assume their code is private or that an old commit no longer matters. Microsoft is blunt that publicly exposed credentials remain usable until they are revoked or rotated. Furthermore, deleting the file does not remove copies kept in commit history, forks, caches, and archives. Any organization whose developers, contractors, or vendors have ever pushed code to a public repository should assume something could be exposed.
The compliance stakes are real as well. Financial institutions covered by the FTC Safeguards Rule must protect access credentials and notify the FTC of qualifying security events. Healthcare organizations must address credential risks in their HIPAA risk analysis. Service providers whose application credentials open doors into customer tenants also face contractual notification duties, which is why Microsoft specifically urges MSPs to review partner access and notify affected customers.
Steps to Take Now
Start by finding what is already exposed. GitHub's secret scanning can detect credentials in repositories you own and alert on leaks in other public repositories. Open-source tools such as Gitleaks can search full commit histories. Treat every secret found as compromised: rotate it, remove it from code and investigate its historical use in sign-in and audit logs.
Next, review Microsoft Entra sign-in logs for service principal activity you cannot explain, particularly invalid or expired secret errors followed by a successful sign-in. Microsoft says this is an urgent sign that someone holds a credential for your application. Remove unused client secrets and certificates from app registrations, and apply Conditional Access policies to workload identities where your licensing allows.
Finally, stop new leaks before they happen. GitHub push protection blocks supported secrets before they reach a repository, and secret checks belong in every build pipeline. Pair these controls with developer training. Many leaks begin with a well-meaning engineer pasting a key into a configuration file to get an integration working.
Moving Beyond Long-Lived Secrets
The lasting fix is to need fewer secrets in the first place. Microsoft recommends moving applications off client secrets and onto managed identities, which remove the credential from code entirely, and using workload identity federation for pipelines and external workloads. Where secrets cannot be avoided, keep them in a dedicated store such as Azure Key Vault with tight access and regular rotation.
These practices line up with established guidance. The OWASP secrets management guidance and the NIST Secure Software Development Framework both treat secret handling as a core part of secure development, not an afterthought. Organizations that build these habits now will be far harder targets for automated tools that never sleep.
How Webcheck Security Can Help
Attackers no longer need to be patient to turn a single leaked key into a full cloud compromise. Finding exposed credentials, hardening Microsoft Entra application identities and reviewing logs for signs of abuse are tasks that benefit from experienced hands, especially for organizations without a dedicated cloud security team.
If you want help scanning your repositories for exposed secrets, assessing your cloud identity configuration, or testing how far an attacker could get with a leaked credential, contact Webcheck Security today. Our team can help you close these gaps before an automated attacker finds them.
Comments