Microsoft says it observed an AI agent move from GitHub secret hunting to Azure Key Vault data theft in five minutes. Its November 5 report documents authenticated cloud abuse following exposed-credential discovery.
The tooling included ARTEX. Searches covered application secrets and AI-service API keys. The researchers saw repository searches from August 2026 and successful service-principal sign-ins from October 28. Some cases involved compromised vendor-owned multitenant application credentials, giving access to downstream customers. The observed activity reached Azure and Microsoft 365 resources.
The distinction matters for response: finding an exposed secret is the beginning of the investigation. Once that identity has authenticated, defenders need to establish what it could reach and what subsequent credentials or data it obtained. A repository cleanup alone cannot answer either question.
Microsoft reports cloud-resource discovery, additional credential collection and data exfiltration. It also describes failed API requests followed by adjusted methods or API versions and successful responses, a sequence it considers consistent with adaptive troubleshooting. The five-minute example is one observed case, not a universal attack timeline.
Follow the application identity after the leak
Microsoft recommends hunting service-principal and non-interactive sign-ins, then correlating cloud audit records and secret access. Its published queries cover Entra, Graph and cloud activity.
A compromised application secret grants an attacker the application’s reach, which depends on its permissions. Microsoft’s application-authentication guidance recommends managed identities for supported Azure resources, avoiding credentials embedded in code. For supported external workloads, federation can also replace stored secrets. Where migration cannot happen immediately, rotate secrets and store them securely while reducing the permissions assigned to the application.
GitHub’s secret-scanning documentation says scanning covers repository history across branches and recommends immediate credential rotation after an alert. Public monitoring can extend detection to leaks by enterprise members in public repositories outside enterprise ownership. This is useful when a search limited to the organization’s own repositories would miss where a credential appeared.
The operational priority is to join the repository alert to the identity investigation. Record which application owned the exposed credential, which resources it was allowed to access and which authentication or audit events followed. That produces a clearer incident boundary than an isolated list of AI-related network fingerprints.
