{"schema_version":"0.10.0","id":"LR-2026-0849","record_version":1,"title":"Threat actors using agentic AI framework (ARTEX) to exploit exposed GitHub secrets and Azure credentials","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":50.7,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":7.04,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-06","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"Microsoft's own report","original_document":{"url":"https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/","organisation":"Microsoft","role":"company"},"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-06","history":[{"date":"2026-11-06","from_level":null,"to_level":"confirmed","reason":"Microsoft's own report"}]},"sources_hash":"2547013d5b7b70c3c0fb6da43bc75544441bb54ff63bb1c7fd7176d0b39ce648"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":"ARTEX","tools_granted":["nmap","curl","wget","python_http_clients","norma_sdk_webfetch","headless_chromium_playwright"],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":"2026-10-28","date_disclosed":"2026-11-05","incident_class":"security_compromise","failure_class":"credential_misuse","agent_involved":true,"secondary_failure_classes":["data_exfiltration"],"trigger":"credential_exposure","duration":null,"detection_method":"third_party","summary":"Starting in August 2026, Microsoft observed threat actors using an agentic AI offensive framework to submit large volumes of queries to GitHub for secrets. In one follow-on attack that began as early as October 28, 2026, an agentic framework used valid leaked or stolen application credentials to access Microsoft Entra ID tenants of certain organizations and connected Azure and Microsoft 365 resources. In one observed case, an AI agent progressed from searching for the client secrets in GitHub to exfiltrating data from Azure Key Vault in five minutes. Microsoft began observing successful service principal sign-ins from October 28, 2026 and investigated the follow-on activity. Publicly exposed credentials remain usable until revoked or rotated.","tags":["agentic-ai","ai-assisted-cyberattack","credential-leak","data-exfiltration","azure-key-vault-exfiltration","entra-id-service-principal-abuse"],"date_detected":null,"near_miss":false,"root_cause":null,"root_cause_detail":null,"failure_class_detail":"Attacker-side agentic framework whose described behaviour is use of valid leaked or stolen application credentials, so credential_misuse is primary and data_exfiltration secondary. Grade D: the mechanism is classified from described behaviour and is not labelled in the source. The framework is the threat actor's tool, not a defender-deployed agent.","responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":"Recommended by Microsoft, not stated as implemented by any victim: revoke or rotate affected credentials immediately and investigate their historical use.","precursor_events":"Scanning activity beginning in August 2026 preceded the follow-on credential abuse that began as early as 2026-10-28."},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Major tier, test met: a live production compromise, with service principal sign-ins into Entra ID tenants of certain organizations and Key Vault exfiltration in some cases. No loss figure, regulator, or record count is stated. The systemic tier is not claimed because the document does not say one shared component correlated loss across deployers.","harm_class":["privacy","third_party_security"],"affected_description":"some impacted customers; multiple downstream tenants","protected_class_involved":null,"data_categories_exposed":["credentials"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/","publisher":"Microsoft Security Blog","date":"2026-11-05","type":"press","title":"Threat actors use agentic AI tooling to find and abuse exposed secrets | Microsoft Security Blog","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.developer":"D","system.harness":"C","system.tools_granted":"C","system.autonomy_level":"D","system.deployment_context":"D","event.date_occurred":"C","event.date_disclosed":"D","event.failure_class":"C","event.secondary_failure_classes":"C","event.trigger":"C","event.detection_method":"C","event.summary":"C","event.tags":"C","event.near_miss":"C","event.adversarial_actor":"C","event.remediation":"C","event.precursor_events":"C","event.incident_class":"C","event.agent_involved":"C","event.failure_class_detail":"C","impact.severity":"C","impact.harm_class":"C","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.severity_because":"C","context.country":"D","context.denominator_available":"D","context.incident_evidence":"C"},"field_citations":{"system.harness":[{"source_index":0,"quote":"However, agentic tooling like ARTEX allows threat actors to not only scan for secrets across multiple repositories at a quicker pace but also use the agents to analyze the output and conduct follow-on attacks, cutting down on the need for the threat actor to have hands-on-keyboard interactions throughout the attack chain."}],"system.tools_granted":[{"source_index":0,"quote":"ARTEX by default uses Nmap, curl, wget, Python HTTP clients, Norma SDK WebFetch, and headless Chromium through Playwright, among others."}],"event.date_occurred":[{"source_index":0,"quote":"In one follow-on attack that began as early as October 28, 2026, an agentic framework used valid leaked or stolen application credentials to access Microsoft Entra ID tenants of certain organizations and connected Azure and Microsoft 365 resources."}],"event.failure_class":[{"source_index":0,"quote":"In one follow-on attack that began as early as October 28, 2026, an agentic framework used valid leaked or stolen application credentials to access Microsoft Entra ID tenants of certain organizations and connected Azure and Microsoft 365 resources."}],"event.secondary_failure_classes":[{"source_index":0,"quote":"In some cases, the agents exfiltrated secrets from the organization’s Azure Key Vault."}],"event.trigger":[{"source_index":0,"quote":"Microsoft Threat Intelligence has observed threat actors using an agentic AI offensive framework to search public GitHub repositories for exposed secrets, including credentials, application credentials, and AI inference-related API keys across multiple applications and cloud services."},{"source_index":0,"quote":"Publicly exposed credentials remain usable until revoked or rotated; removing the original disclosure alone does not remediate the exposure."}],"event.detection_method":[{"source_index":0,"quote":"As early as October 28, 2026, Microsoft began observing successful service principal sign-ins from the IP address 199.19.77[.]84 involving multiple application IDs across some impacted customers, including cases where a multitenant application credential was compromised at the source (vendor-owned application) and used to access multiple downstream tenants."}],"event.summary":[{"source_index":0,"quote":"Starting in August 2026, Microsoft observed threat actors using an agentic AI offensive framework to submit large volumes of queries to GitHub for secrets."},{"source_index":0,"quote":"In one follow-on attack that began as early as October 28, 2026, an agentic framework used valid leaked or stolen application credentials to access Microsoft Entra ID tenants of certain organizations and connected Azure and Microsoft 365 resources."},{"source_index":0,"quote":"In one observed case, an AI agent progressed from searching for the client secrets in GitHub to exfiltrating data from Azure Key Vault in five minutes."},{"source_index":0,"quote":"As early as October 28, 2026, Microsoft began observing successful service principal sign-ins from the IP address 199.19.77[.]84 involving multiple application IDs across some impacted customers, including cases where a multitenant application credential was compromised at the source (vendor-owned application) and used to access multiple downstream tenants."},{"source_index":0,"quote":"Publicly exposed credentials remain usable until revoked or rotated; removing the original disclosure alone does not remediate the exposure."}],"event.tags":[{"source_index":0,"quote":"Starting in August 2026, Microsoft observed threat actors using an agentic AI offensive framework to submit large volumes of queries to GitHub for secrets."},{"source_index":0,"quote":"Microsoft Threat Intelligence has observed threat actors using an agentic AI offensive framework to search public GitHub repositories for exposed secrets, including credentials, application credentials, and AI inference-related API keys across multiple applications and cloud services."},{"source_index":0,"quote":"In one observed case, an AI agent progressed from searching for the client secrets in GitHub to exfiltrating data from Azure Key Vault in five minutes."},{"source_index":0,"quote":"In some cases, the agents exfiltrated secrets from the organization’s Azure Key Vault."},{"source_index":0,"quote":"In one follow-on attack that began as early as October 28, 2026, an agentic framework used valid leaked or stolen application credentials to access Microsoft Entra ID tenants of certain organizations and connected Azure and Microsoft 365 resources."}],"event.near_miss":[{"source_index":0,"quote":"In some cases, the agents exfiltrated secrets from the organization’s Azure Key Vault."}],"event.adversarial_actor":[{"source_index":0,"quote":"These threat actors can then use the secrets for further malicious activity against the compromised organization."}],"event.remediation":[{"source_index":0,"quote":"Immediately revoke or rotate the affected credentials and investigate their historical use."}],"event.precursor_events":[{"source_index":0,"quote":"Starting in August 2026, Microsoft observed threat actors using an agentic AI offensive framework to submit large volumes of queries to GitHub for secrets."}],"event.incident_class":[{"source_index":0,"quote":"In one follow-on attack that began as early as October 28, 2026, an agentic framework used valid leaked or stolen application credentials to access Microsoft Entra ID tenants of certain organizations and connected Azure and Microsoft 365 resources."},{"source_index":0,"quote":"In some cases, the agents exfiltrated secrets from the organization’s Azure Key Vault."}],"event.agent_involved":[{"source_index":0,"quote":"In one follow-on attack that began as early as October 28, 2026, an agentic framework used valid leaked or stolen application credentials to access Microsoft Entra ID tenants of certain organizations and connected Azure and Microsoft 365 resources."},{"source_index":0,"quote":"In one observed case, an AI agent progressed from searching for the client secrets in GitHub to exfiltrating data from Azure Key Vault in five minutes."}],"event.failure_class_detail":[{"source_index":0,"quote":"In one follow-on attack that began as early as October 28, 2026, an agentic framework used valid leaked or stolen application credentials to access Microsoft Entra ID tenants of certain organizations and connected Azure and Microsoft 365 resources."}],"impact.severity":[{"source_index":0,"quote":"In one follow-on attack that began as early as October 28, 2026, an agentic framework used valid leaked or stolen application credentials to access Microsoft Entra ID tenants of certain organizations and connected Azure and Microsoft 365 resources."},{"source_index":0,"quote":"In some cases, the agents exfiltrated secrets from the organization’s Azure Key Vault."},{"source_index":0,"quote":"As early as October 28, 2026, Microsoft began observing successful service principal sign-ins from the IP address 199.19.77[.]84 involving multiple application IDs across some impacted customers, including cases where a multitenant application credential was compromised at the source (vendor-owned application) and used to access multiple downstream tenants."}],"impact.harm_class":[{"source_index":0,"quote":"In some cases, the agents exfiltrated secrets from the organization’s Azure Key Vault."},{"source_index":0,"quote":"The compromised applications subsequently accessed SharePoint and OneDrive in the targeted organization tenants, including file downloads and mailbox-item access."}],"impact.affected_description":[{"source_index":0,"quote":"As early as October 28, 2026, Microsoft began observing successful service principal sign-ins from the IP address 199.19.77[.]84 involving multiple application IDs across some impacted customers, including cases where a multitenant application credential was compromised at the source (vendor-owned application) and used to access multiple downstream tenants."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"The threat actor targeted operations that return credentials, including storage account keys, App Service settings, connection strings and publishing credentials, AI and machine learning (ML) connections and datastores, and Azure Kubernetes Service (AKS) user credentials."}],"impact.severity_because":[{"source_index":0,"quote":"In one follow-on attack that began as early as October 28, 2026, an agentic framework used valid leaked or stolen application credentials to access Microsoft Entra ID tenants of certain organizations and connected Azure and Microsoft 365 resources."},{"source_index":0,"quote":"In some cases, the agents exfiltrated secrets from the organization’s Azure Key Vault."},{"source_index":0,"quote":"As early as October 28, 2026, Microsoft began observing successful service principal sign-ins from the IP address 199.19.77[.]84 involving multiple application IDs across some impacted customers, including cases where a multitenant application credential was compromised at the source (vendor-owned application) and used to access multiple downstream tenants."}],"context.incident_evidence":[{"source_index":0,"quote":"Microsoft has also investigated follow-on activity involving the misuse of valid application credentials."}]},"notes_on_gaps":"One campaign is grouped as one incident because the document presents the GitHub scanning and the follow-on credential abuse as a single chain. The document does not name ARTEX as the tool used in the observed activity; it says 'agentic tooling like ARTEX' and elsewhere 'suspected ARTEX use', so the harness value is a judgement call. The threat actor's agent is the attacker's tool, so agent_involved is set true on the attacker side; failure_class values describe that mechanism and are grade D. The five-minute interval is attack progression, not failure persistence, so duration and time_to_contain are null. date_disclosed is not stated in the document text; the collector metadata was not used, so it is null. Date_detected is not separately stated; the 2026-10-28 observation date coincides with the activity start. No loss figures, record counts, third-party counts, or durations are stated. Root cause, responsible party and control failures are not stated for this incident. Autonomy level is not stated, so unknown is used rather than full-auto. The separate reconnaissance from 157.22.126[.]128 and the exploitation attempts from 65.87.223[.]26 are not attributed to an agent and are excluded. The multitenant application credential case may be a systemic exposure, but the document does not quantify it, so systemic_exposure is left null and severity is held at major. Extractor proposed values without quotes; dropped: ['context.country', 'context.denominator_available', 'system.autonomy_level', 'system.deployment_context', 'system.developer']. Single secondary source; corroborate before upgrading any field to B. [2026-11-06: evidence level set: Confirmed (Microsoft's own report)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":{"log_completeness":null,"tamper_evidence":null,"timestamp_reliability":"unknown","investigation_independence":"internal","redaction_summary":null,"analysis_method":"unknown","prompt_output_retention":null},"regulatory":null,"coverage":null}}