# ARTEX: an agent went from GitHub secrets to Azure Key Vault in 5 minutes

> Microsoft says attackers let an agentic framework find exposed secrets and use them, moving from GitHub search to cloud theft in minutes.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Incident, Attack
- **Published by:** Microsoft
- **Disclosed:** 2026-11-05
- **Affects:** Microsoft Entra ID, Azure Key Vault, Azure SQL, Azure DevOps, Microsoft 365
- **Research by:** Microsoft Threat Intelligence, Microsoft Security Research
- **Primary source:** https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/
- **Page:** https://theinjection.dev/items/microsoft-artex-github-secret-abuse/

Microsoft Threat Intelligence reports threat actors driving the ARTEX agentic offensive framework to search GitHub for cloud and AI service secrets, then sign in as OAuth service principals across Azure tenants.

## What happened

Microsoft Threat Intelligence and Microsoft Security Research published this campaign on November 5, 2026. Starting in August 2026, they observed threat actors using an agentic AI offensive framework to submit large volumes of GitHub queries for secrets, often pairing a target organization's name with cloud or AI service keywords. Microsoft does not attribute the activity to a named group.

## How it works

ARTEX is an agentic offensive framework whose default tools include Nmap, curl, wget, Python HTTP clients, Norma SDK WebFetch and headless Chromium through Playwright. Once a client secret was found, the agent signed in as that application's service principal, enumerated resources through Azure Resource Manager and read whatever the role allowed. The agent also corrected its own mistakes: a Key Vault secret-enumeration batch that returned HTTP 400 for using a data-plane API version was rerun about 28 seconds later with ARM version 2023-07-01 and returned HTTP 200.

## Who is affected

Organizations whose OAuth application secrets, certificates or tokens ever reached a public repository are in scope, as are tenants that trust a vendor-owned multitenant application: Microsoft says one such credential was used to reach downstream tenants. Service principal sign-ins were seen across dozens of applications in multiple tenants from October 28, 2026, with separate reconnaissance against AI workloads on Azure AI services.

## What to do

Treat any credential that reached a public repository as compromised, rotate it, review its historical use, and rotate everything in any Key Vault the affected applications could read. Remove client secrets, certificates and federated credentials from affected app registrations, revoke Entra sessions and Azure DevOps personal access tokens, and move OAuth applications to managed identities.

## Quick facts

- **Affected:** Entra ID service principals, Azure Key Vault, Storage, App Service, AKS, Azure SQL, Application Insights, Azure DevOps, Microsoft 365
- **Attack type:** Agentic credential hunting in public repositories, then OAuth service principal sign-in
- **Speed:** Five minutes from searching GitHub for secrets to exfiltrating Azure Key Vault data, in one observed case
- **Timeline:** GitHub secret queries from August 2026; successful service principal sign-ins from October 28, 2026
- **Indicators:** Sign-ins from 199.19.77[.]84 and 199.19.77[.]18; exploitation from 65.87.223[.]26; recon from 157.22.126[.]128
- **Found by:** Microsoft Threat Intelligence and Microsoft Security Research
- **Status:** Active, with no patch to apply: exposure follows the leaked credential

## Questions

### How do I check whether an attack agent used my leaked OAuth secret?

Microsoft advises reviewing service principal and other non-interactive sign-in logs for failures followed quickly by successes, and for one address authenticating to three or more service principals with mixed results. Sign-in errors AADSTS7000215 and AADSTS7000222 show invalid or expired secrets being tried. Microsoft's hunting queries start at 2026-10-28T00:00:00Z and also cover Azure Activity, Key Vault, Entra audit and Azure DevOps logs.

### Does deleting a secret from a public repository make it safe again?

Microsoft states that publicly exposed credentials should be treated as compromised even after removal, because an agent may already hold them. Rotate the credential, review its historical use, and rotate everything in any Key Vault the affected application could read. Microsoft also recommends migrating OAuth applications from secret-based authentication to managed identities and restricting who may register applications.

### Which Azure services did the agents reach after signing in?

Microsoft observed the agents reading Azure Key Vault and Storage accounts, enumerating App Service, Azure Kubernetes Service, Azure SQL and Application Insights, searching Azure DevOps for further secrets, and running commands on virtual machines through Run Command. SharePoint, OneDrive and mailbox items were reached through Microsoft Graph. The agents repeatedly sought API keys for major AI providers.

### Do honeypots help against an autonomous attack agent?

Microsoft reports that honeypots, decoys, tarpits and fake wins reduced attack traffic reaching real assets in its own testing, and produced high-confidence signal. Decoys hand the agent worthless targets, tarpits spend its time and budget, and a false success can make it stop early. Microsoft presents these as additions to least privilege and secret hygiene, not replacements.

## Sources

1. [Microsoft Analysis](https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/)
2. [Earlier ARTEX Campaign](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/)