Microsoft Says an AI Agent Went From a Code Search to Stolen Cloud Data in Five Minutes
Microsoft says attackers are using an AI agent framework to comb public code on GitHub for leaked credentials, and that in at least one case the agent went from a GitHub search to taking data out of an Azure Key Vault, Microsoft's own service for storing passwords and keys, in five minutes. Microsoft Threat Intelligence and Microsoft Security Research published the account on the company's security blog Nov. 5, 2026.
Searching public code for credentials is not new. What Microsoft says has changed is the speed: the technique has been limited by how long a human needs to find the repositories and read them, while an agent can query at machine pace, read its own results and start the next step with nobody at a keyboard.
Microsoft says it first saw the framework, which it names as ARTEX, putting large volumes of queries to GitHub in August 2026. From as early as Oct. 28, 2026, it reports successful sign-ins by application identities from a single internet address across several customer organizations. Application identities are the accounts software uses to log in on its own. Microsoft says that in some cases a credential stolen from a vendor was used to reach that vendor's own customers, and that the agents showed a repeated interest in keys for AI services. It has published the internet addresses it tied to the activity so that defenders can block them.
All of it comes from Microsoft's own monitoring of its own cloud, and nobody outside the company has audited it. Microsoft says the security firm Todyl reported a similar campaign involving the same addresses.
Microsoft says an organization that finds its secrets in a public repository should treat them as compromised and rotate them at once: a published credential stays usable until it is revoked, and deleting the file does not fix it, because copies survive in edit history, caches and logs. It also recommends moving applications off stored secrets and onto identities the cloud manages for them, and cutting each application's permissions to what it actually needs.
