Cases › security breach › LR-2026-0849

Threat actors using agentic AI framework (ARTEX) to exploit exposed GitHub secrets and Azure credentials

Confirmed Why: Microsoft's own report · Microsoft · 1 independent report

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: advice only, no fix reported

Severity major

Reported 5 Nov 2026

Agent tool ARTEX

Could do nmap, curl, wget, python http clients, norma sdk webfetch, headless chromium playwright

No source states: money lost or records count, developer and model, deployer, industry.

Severity major: tier, test met: a live production compromise, with service principal sign-ins into Entra ID tenants of certain organizations and Key Vault exfiltration in some cases. No loss figure, regulator, or record count is stated. The systemic tier is not claimed because the document does not say one shared component correlated loss across deployers.

Starting in August 2026, Microsoft observed threat actors using an agentic AI offensive framework to submit large volumes of queries to GitHub for secrets. In one follow-on attack that began as early as October 28, 2026, an agentic framework used valid leaked or stolen application credentials to access Microsoft Entra ID tenants of certain organizations and connected Azure and Microsoft 365 resources. In one observed case, an AI agent progressed from searching for the client secrets in GitHub to exfiltrating data from Azure Key Vault in five minutes. Microsoft began observing successful service principal sign-ins from October 28, 2026 and investigated the follow-on activity. Publicly exposed credentials remain usable until revoked or rotated.

What happened

No source tells the story step by step yet.

What was done

Advice in source, not a fix by the party

“Recommended by Microsoft, not stated as implemented by any victim: revoke or rotate affected credentials immediately and investigate their historical use.”

Short-lived, scoped credentials

Risks

Credential and privilege abuse
Primary42 incidents

AI used to run a cyber attack
Also106 incidents
Rising: 25 vs 4.2 a week

AI system attacked or breached
Also20 incidents

Sorted by rule from the case's fields; not yet read from the sources.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Application

Short-lived, scoped credentials · Secrets kept out of the model's context · Separate identity for each agent · Least-privilege access for the agent · Alerts on unusual tool use · Activity logs · Sensitive-data checks on outbound data

Infrastructure / target

Multi-factor sign-in and password policy · Secrets scanning

Evidence

What set it off exposed credentials
What was done Recommended by Microsoft, not stated as implemented by any victim: revoke or rotate affected credentials immediately and investigate their historical use.

No source states: a step-by-step account, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause.

Show every field, with its source and grade