Hackers use agentic AI to find and exploit secrets on GitHub

The rise of agentic scanning

Microsoft's Threat Intelligence unit recently identified a shift in how hackers find targets. Instead of manual searching, threat actors are employing agentic AI tools to hunt for exposed passwords and application credentials. These tools are specifically designed to scan public GitHub repositories for sensitive information that developers might have accidentally left behind.

Agentic AI refers to systems that can perform multi-step tasks autonomously. In this context, the AI does not just find a piece of data; it can identify valuable credentials and then carry out follow-up attacks. This automation allows hackers to scale their efforts across thousands of repositories simultaneously without needing constant human input.

As reported by Digit, Microsoft found that these tools can identify specific application IDs and keys across several different customers. By automating the discovery phase, hackers can find high-value targets much faster than traditional methods allowed. This creates a persistent threat for any organization that hosts code on public platforms.

From GitHub to cloud theft

The speed of these attacks is one of the most concerning factors for security teams. Microsoft shared an incident where an AI agent moved from searching GitHub for secrets to stealing data from an organization's Azure Key Vault in just five minutes. This rapid progression shows how quickly an exposed string of text can turn into a full-scale data breach.

Once the AI agent gains entry, it begins to explore the environment. The company noted that the tools accessed Azure Storage Accounts, downloaded files from SharePoint and OneDrive, and attempted to find even more credentials. The goal is to move deeper into the network to find the most sensitive data possible.

In some instances, the AI even targeted AI and machine learning services. By using the compromised credentials, the attackers were able to explore these specific cloud resources. This demonstrates that the AI's primary goal is to maximize the impact of the initial breach by seeking out high-value infrastructure.

Impact on multi-tenant systems

A particularly dangerous trend identified by Microsoft involves the targeting of vendor-owned applications. If a single application is used by multiple different organizations, a hacker who steals its credentials can potentially access several customer environments at once. This creates a massive ripple effect where one mistake by a vendor can compromise many clients.

The attackers have been detected using specific IP addresses to perform successful automated login attempts. These attempts used multiple application IDs across various affected customers. This systematic approach allows hackers to cast a wide net, looking for any door that the AI can unlock using the stolen credentials.

Because these applications are often multitenant, the risk is amplified. A single compromised credential for a shared service can provide a gateway to a wide variety of environments. This makes it critical for organizations to understand not just their own security, but the security of the third-party tools they integrate into their workflows.

The ARTEX framework and detection

Microsoft identified a specific agentic AI framework called ARTEX being used by these threat actors. The malicious activity involving this framework was detected beginning in August 2026. The tool was specifically utilized to search for sensitive information on public repositories, highlighting how accessible these AI frameworks are to bad actors.

To counter these threats, Microsoft recommends that organizations treat every publicly exposed credential as compromised. They warn that simply editing or deleting the code where the secret was found does not invalidate the credential. Once a secret is public, it must be considered compromised and requires immediate action.

The company advises that organizations should promptly rotate or revoke any affected certificates, API keys, and application secrets. They also suggest checking various logs, including those for Azure activity and Key Vault access, to spot any unusual behavior that might indicate a breach.

Defending against automation

To protect against AI-powered attacks, Microsoft suggests several specific technical shifts. Organizations should avoid storing long-term passwords or secret keys directly in their code. Instead, they recommend using managed identities, which provide a more secure way for applications to authenticate without hardcoded secrets.

Security teams are also encouraged to use decoys—fake systems intended to lure in attackers. These setups help security teams spot suspicious activity and identify threats before they can reach actual data. Using these lures can provide an early warning that an automated agent is scanning the network.

Finally, Microsoft advises strengthening monitoring through tools like Microsoft Defender for Cloud. Organizations should review sign-in history for Entra ID and other relevant logs. By looking for suspicious patterns in these records, teams can better identify the automated behavior of AI agents as they move through a system.