Threat actors use agentic AI tooling to find and abuse exposed secrets

Threat actors are utilizing agentic AI offensive frameworks, such as ARTEX, to rapidly search public GitHub repositories for exposed secrets like credentials and API keys across various applications and cloud services. This method accelerates the traditional process of secret discovery by allowing agents to scan multiple repositories concurrently and conduct follow-on attacks with minimal human intervention, exemplified by an agent advancing from scanning GitHub to exfiltrating data from Azure Key Vault in five minutes.
Follow-on activity involved exploiting valid application credentials to gain access to Microsoft Entra ID tenants, leading to service principal sign-ins across multiple applications, the discovery of cloud resources, and exfiltration of data from services like Azure Key Vaults and Storage Accounts. The attack also included adaptive behavior where agents manipulated Azure Resource Manager API calls to test and bypass version checks on resource metadata, indicating an ability to perform adaptive troubleshooting in cloud environments.
Organizations are advised to implement layered defenses by scanning codebases for secrets, rotating exposed credentials immediately, enforcing least privilege through workload identities, and enabling comprehensive Microsoft Defender for Cloud protections across Azure services. Mitigation strategies also involve behavioral detection, such as monitoring for patterns like repeated authentication attempts from specific IP addresses or suspicious API calls across multiple cloud resources, alongside defensive measures like using honeypots to divert agentic activity.

* Threat actors use an agentic AI offensive framework to search public GitHub repositories for exposed secrets, including credentials and API keys.
* An AI agent advanced from scanning GitHub for secrets to exfiltrating data from Azure Key Vault in five minutes in one observed case.
* Attackers used valid leaked application credentials to access Microsoft Entra ID tenants and connect Azure/Microsoft 365 resources starting October 28, 2026.
* The agentic framework led to credential and data exfiltration from Azure Key Vaults and Storage Accounts, and abuse of Azure AI services.
* Malicious activity originated from IP addresses including 199.19.77[.]84 and 65.87.223[.]26.
* The agent demonstrated adaptive troubleshooting on Azure Resource Manager (ARM) instances, manipulating HTTP methods and API versions to enumerate metadata across Key Vaults and SQL server firewall rules.
* Agents obtained tokens for single-tenant OAuth applications and used them to enumerate other cloud resources in the organization, including exfiltrating secrets from Azure Key Vault.
* Attackers focused on credentials providing access to AI services, such as API keys and OAuth applications accessing Foundry Tools (Azure Cognitive Services).
* Containment recommendations include blocking IP addresses in Conditional Access policies and revoking application credentials immediately.
* Detection strategies involve reviewing Entra ID sign-in logs, Azure Activity, Key Vault diagnostics, and specific hunting queries targeting suspicious IP activity.

The narrative describes an acceleration of the cyber kill chain driven by the integration of autonomous AI agents into penetration testing methodologies. The core implication is a shift from slow, manual reconnaissance and exploitation to high-speed, multi-stage attacks that leverage legitimate credentials and platform APIs with machine-like adaptability. The transition observed—from finding a secret in public code to exfiltrating cloud data—highlights that the vulnerability lies not just in the existence of a secret but in the automated capacity to chain disparate access points across different security domains (code, identity, cloud services).
The emphasis on agentic tools like ARTEX suggests a future where defenders must move beyond static perimeter defenses and focus on modeling and disrupting autonomous workflows. The threat is no longer merely about exposing secrets; it is about weaponizing the speed of information processing to achieve comprehensive lateral movement within complex cloud infrastructures. The defense strategy shifts from solely protecting repositories or individual credentials to securing the integrity of identity relationships, API versioning across control planes, and the flow of data between services, as evidenced by the agent's ability to adapt ARM requests.
The proposed mitigations—especially focusing on credential lifecycle management, workload identity restrictions (least privilege), and behavioral detection focused on multi-step activity rather than single events—address this systemic challenge. The defense against AI agents must incorporate mechanisms that disrupt their operational tempo or introduce high levels of friction where automated chaining is impossible. The focus on defensive decoys and behavioral signals reflects the necessary pivot toward anticipating autonomous action rather than reacting to individual artifacts.
Bridge Questions: If agentic tools can rapidly chain legitimate API calls across different cloud services, what new governance models are needed to manage the lifecycle and permissions of these programmatic identities? How does the speed advantage gained by AI change the acceptable risk tolerance for automated access within enterprise environments? What is the efficacy of behavioral detection when the adversary can dynamically alter fingerprints like IP addresses and user agents in real-time?