Threat actors use agentic AI tooling to find and abuse exposed secrets

Threat actors are increasingly leveraging agentic AI offensive frameworks to accelerate cyberattacks, beginning with automated scanning of public code repositories like GitHub for exposed sensitive information such as credentials and API keys. This capability allows malicious entities to rapidly identify targets across numerous applications and cloud services without constant manual operator intervention. Incidents observed involve agents moving from secret discovery to active compromise, such as exfiltrating data from Azure Key Vault in minutes.
Subsequent attack stages have shown misuse of valid application credentials within Microsoft Entra ID tenants. These compromised identities facilitate extensive reconnaissance—mapping environments by querying Azure Resource Manager (ARM), Storage Accounts, and leveraging AI services—followed by credential and data exfiltration, including accessing SharePoint and OneDrive. Adversarial activities have also involved adaptive behavior on cloud APIs, where agents dynamically adjusted request versions to bypass control plane restrictions.
Mitigation requires an organization-wide focus: immediately rotating all exposed secrets, enforcing least privilege across service principals, migrating away from secret-based authentication toward managed identities, and implementing advanced detection through services like GitHub Advanced Security and Microsoft Defender for Cloud.

Agentic AI offensive frameworks are observed scanning public GitHub repositories for exposed secrets, including credentials and API keys.
Threat actors can utilize these agents to scan multiple repositories at a faster pace than human operators.
In one recorded instance, an AI agent progressed from searching GitHub for secrets to exfiltrating data from Azure Key Vault in five minutes.
As of October 28, 2026, successful service principal sign-ins were observed from IP address 199.19.77[.]84 involving multiple application IDs across impacted customers.
The threat actor used compromised credentials for cloud resource discovery and exfiltration from Azure Key Vaults and Storage Accounts.
Malicious operations originating from 65.87.223[.]26 included indications of vulnerability exploitation via embedded shell commands in a user agent.
Reconnaissance operations targeting AI workloads on Azure AI services were observed from IP address 157.22.126[.]128.
The agents used compromised OAuth applications to enumerate other cloud resources and exfiltrate secrets from Azure Key Vaults.
Adaptive behavior was demonstrated in ARM interactions, where requests returned HTTP 400 due to outdated API versions before succeeding with a supported version.
Microsoft recommends organizations scan their code base and immediately rotate any exposed keys or credentials.

The acceleration of the attack chain by agentic AI represents a structural shift in cyber risk, moving security threats from human-paced enumeration to machine-speed execution across complex infrastructures. The narrative strongly positions these autonomous tools as an existential catalyst for increased organizational exposure, framing the adoption of advanced defensive tooling—like Microsoft's suite offerings—as a necessity against this evolving technological threat vector. This structure subtly frames remediation not merely as a technical patch (rotating keys) but as a necessary competitive upgrade in security intelligence capabilities.
The core assumption driving the warning is that detection latency has fundamentally increased; an exploit once taking weeks of human effort can now occur in minutes autonomously. The observed follow-on activities—using service principal tokens to map environments via ARM, then downloading files from SharePoint—illustrate an integrated attack flow that requires deep visibility across identity (Entra ID), secrets management (Key Vault), and operational resources (Azure services).
The pervasive nature of this trend implies a widening asymmetry between threat actor capability and defensive agility. While Microsoft provides robust lists of detections, the constant evolution of AI agents means defenders are in an ongoing game of pattern recognition against deliberately polymorphic activity. The advice to "move away from secret-based authentication" is less a recommendation and more an urgent mandate to fundamentally redesign application trust models toward zero-trust architectures based on identity assurance rather than static secrets.
Patterns detected: ARC-0154 Authority Game, ARC-0268 Fear Appeal
Root Cause: The fundamental centralization of digital infrastructure (cloud services) coupled with the parallel democratization of highly capable automation tools creates an accelerating feedback loop of risk that far outstrips traditional linear defense scaling. The unstated assumption is that governance controls (like Least Privilege) can effectively contain non-human, rapidly adaptive, intelligent actors indefinitely.
Implications: Human agency in security shifts from reactive maintenance to proactive architectural de-risking. Costs are concentrated heavily on organizations lacking the resources for constant AI/behavioral monitoring; they bear the cost of system compromise while vendors profit from providing the diagnostic and defensive tooling required to maintain perceived safety.
Bridge Questions: If threat actors achieve near-perfect autonomy in reconnaissance, what non-computational factors—such as business process friction or geopolitical alignment—become the most effective choke points for attack progression? How does relying on detection of *behavior* (e.g., rapid multi-service polling) risk creating a high rate of false positives that leads to defensive complacency? What is the long-term ethical liability of an organization whose internal systems are primarily governed by AI agents, both malicious and protective?
Autonomy check: Real-world incidents describing AI agents progressing from scan to exfiltration are documented. No signals were observed regarding self-preservation or overriding human oversight in these reported events; actions described are strictly within the scope of directed offensive operations authorized or executed by the threat actor leveraging available tooling.