The short answer
- Microsoft observed threat actors searching public GitHub repositories for secrets, including AI inference API keys, starting in August 2026.
- One follow-on attack began as early as October 28, 2026 and used leaked or stolen application credentials to access Entra ID tenants and connected cloud resources.
- In one observed case, Microsoft says an AI agent went from searching GitHub for client secrets to exfiltrating Azure Key Vault data in five minutes.
- Microsoft says exposed credentials remain usable until revoked or rotated; deleting the disclosure does not remediate exposure.
- Microsoft recommends scanning an organization’s own code, rotating exposed credentials immediately and favoring managed identities over long-lived secrets.
Microsoft reported on November 5, 2026 that threat actors were using the ARTEX agentic framework to search public GitHub repositories for exposed secrets, including AI inference API keys. Its Threat Intelligence post describes one observed case in which an AI agent went from searching for client secrets to exfiltrating Azure Key Vault data in five minutes.
That is a single case, not a typical attack duration. Microsoft's central advice is to rotate or revoke exposed credentials immediately, rather than assume deleting the public disclosure makes them safe.
#What did Microsoft observe, and when?
Microsoft dates the observed repository-search activity to August 2026. That marks when it observed the scanning, not when ARTEX launched. The company says agentic tooling can scan multiple repositories, analyze results and carry out follow-on attacks with less hands-on interaction from operators.
The exposed material included credentials, application credentials and AI inference-related API keys across applications and cloud services. Microsoft says agents repeatedly focused on credentials granting access to AI services, including major providers' API keys and applications with access to Foundry Tools. It does not identify specific AI providers in the permitted account of that activity.
Cybersecurity Dive, reporting on November 6, 2026, wrote: "It is not immediately clear who is behind the scanning of GitHub repositories." Microsoft names no actor behind this campaign. Neither report identifies victims in the campaign accounts used here.
#What happened in the five-minute case?
Microsoft describes a follow-on attack beginning as early as October 28, 2026. Leaked or stolen application credentials were used to access Microsoft Entra ID tenants and connected Azure and Microsoft 365 resources. The company reports credential and data exfiltration from Azure Key Vaults and Storage Accounts, as well as abuse of Azure AI services.
The timing claim is precise and limited: "In one observed case, an AI agent progressed from searching for the client secrets in GitHub to exfiltrating data from Azure Key Vault in five minutes."
The sources do not establish that all scanning led to theft, that all cloud activity involved one operator, or that five minutes is representative. This is an account of exposed credentials being abused, not a reported software vulnerability in GitHub or Azure.
#What should organizations do about exposed secrets?
Microsoft recommends checking an organization's own GitHub code for secrets, removing them and immediately rotating exposed keys or credentials. It says: "Organizations that find their secrets exposed in public repositories must assume that the exposed secrets and associated applications are compromised."
The defensive steps in Microsoft's post are:
- Find and remove exposed secrets. Inspect the organization's own code for credentials and avoid putting secrets in source code, configuration files, repositories or issues.
- Revoke or rotate immediately. Microsoft says: "Immediately revoke or rotate the affected credentials and investigate their historical use."
- Do not equate deletion with remediation. Microsoft warns that credentials remain usable until revoked or rotated, even after their original location is edited or deleted.
- Reduce long-lived credentials. Where supported, Microsoft recommends mechanisms such as managed identities for application authentication instead of long-lived client secrets embedded in code.
Deleting content cannot invalidate the credential. Microsoft also warns that copies can persist in edit histories, caches, archives, logs and other systems. Cybersecurity Dive separately reported Microsoft's advice to assume exposed repository secrets have been compromised.
#How does this relate to earlier ARTEX coverage?
Our earlier Microsoft ARTEX coverage concerns a separate campaign. It is related reading only, not attribution of the GitHub-secrets activity described here. For another developer-security incident, see our report on the malicious Claude Code extension in Cursor's marketplace.
Our analysis: The five-minute observation makes the response window concrete, but it should not become a universal speed claim. The operational distinction is between removing information from a repository and invalidating the access it grants. Microsoft's guidance addresses both: clean up exposed material, revoke or rotate the credential, and investigate its use. Managed identities reduce reliance on secrets stored in code; they are not a claim that every possible cloud attack disappears.
#What is unclear?
- Attribution: Microsoft does not name the actors behind this campaign.
- Scale: the number of affected organizations and total stolen-data volume are not established.
- Typical duration: one five-minute case does not establish how long other attacks took.
Frequently asked questions
Did every attack take five minutes?
No. Microsoft describes one observed case. The sources do not establish a typical duration for this activity.
When did Microsoft observe the scanning?
Microsoft says it observed the GitHub-search activity starting in August 2026. That is an observation date, not an ARTEX launch date. One follow-on attack began as early as October 28, 2026.
Does deleting a leaked secret fix the problem?
No. Microsoft says publicly exposed credentials remain usable until revoked or rotated. Removing the original disclosure neither invalidates the credential nor eliminates retained copies.
Which resources were affected?
Microsoft reports access to Entra ID tenants and connected Azure and Microsoft 365 resources, including credential and data theft from Azure Key Vaults and Storage Accounts, and abuse of Azure AI services.
Who was behind this activity?
Microsoft does not name the actors behind this campaign. Cybersecurity Dive reported that responsibility for the repository scanning was not immediately clear.
Sources
Every factual claim in this article traces back to one of these.
One email a week on AI agents and bots.
Launches, pricing and rollout changes and the guides worth reading. At most once a week, and you can leave with one click.
