{"url":"https://newsforagent.com/news/2026-11-06/microsoft-agentic-ai-github-secrets-warning","markdown_url":"https://newsforagent.com/news/2026-11-06/microsoft-agentic-ai-github-secrets-warning.md","title":"Microsoft Warns AI Agents Are Hunting GitHub Secrets","headline":"Microsoft Warns Hackers Use Agentic AI to Find Exposed GitHub Secrets and Breach Cloud Systems","description":"Microsoft's Threat Intelligence unit says agentic AI tools are scanning public GitHub repositories for exposed credentials.","section":"Incidents","published_at":"2026-11-06T09:38:04+00:00","modified_at":"2026-11-06T09:38:04+00:00","author":"News Desk","key_takeaways":["Microsoft's Threat Intelligence unit traced malicious activity beginning in August 2026 to an agentic AI framework called ARTEX that searched public GitHub repositories for exposed secrets.","In one incident, an AI agent moved from searching GitHub for exposed secrets to stealing data from an organization's Azure Key Vault in five minutes.","Microsoft advised organizations to treat every publicly exposed credential as compromised and to revoke or rotate affected passwords, API keys, application secrets and certificates."],"companies":[{"name":"Microsoft","is_primary":true,"profile_url":"https://akta.pro/company-profiles/000026e/microsoft","website":"https://www.microsoft.com"}],"source":{"publisher":"Digit","title":"Hackers turn to agentic AI to find exposed secrets on GitHub, warns Microsoft","url":"https://www.digit.in/news/general/hackers-turn-to-agentic-ai-to-find-exposed-secrets-on-github-warns-microsoft.html"},"other_sources":[],"tags":["Incidents","Microsoft"],"body_markdown":"[Microsoft](https://akta.pro/company-profiles/000026e/microsoft) has warned that hackers are using agentic AI tools to find exposed passwords, application credentials and API keys on public GitHub repositories and use them to break into cloud systems, with one AI agent reaching an organization's Azure Key Vault in five minutes. [Digit](https://www.digit.in/news/general/hackers-turn-to-agentic-ai-to-find-exposed-secrets-on-github-warns-microsoft.html) reported the warning from the company's Threat Intelligence unit.\n\n## Inside Microsoft's ARTEX Findings\n\nMicrosoft said in a blog post that the malicious activity began in August 2026, with attackers using an agentic AI framework called ARTEX to search public GitHub repositories for sensitive information. The company said the automated tools can scan multiple repositories, identify valuable credentials and carry out follow-up attacks with limited human involvement.\n\nDuring its investigation, Microsoft detected successful automated login attempts from the IP address 199.19.77[.]84 using multiple application IDs across several affected customers. In some cases, attackers had stolen the credentials of a vendor-owned application used by multiple organizations, allowing them to access several customer environments.\n\nMicrosoft said the AI tool searched cloud resources, accessed Azure Key Vaults and Storage Accounts, downloaded files from SharePoint and OneDrive, and attempted to obtain additional credentials. Some compromised applications were also used to explore AI and machine learning services, and in certain cases attackers targeted credentials belonging to multitenant applications, potentially allowing access to several customer environments through a single compromised application.\n\n## Microsoft's Guidance for Exposed Credentials\n\nMicrosoft advised organizations to treat every publicly exposed credential as compromised, even if the original code has been edited or deleted, noting that removing exposed information does not invalidate the credentials. The company recommended immediately revoking or rotating affected passwords, API keys, application secrets and certificates, and reviewing Entra ID sign-in records, Azure activity logs and Key Vault access records for suspicious behavior.\n\nTo prevent AI-powered attacks, Microsoft recommended avoiding long-term passwords or secret keys in code and using managed identities instead, granting users and applications only the access they need, enabling GitHub tools to detect and block exposed secrets, and improving security monitoring with Microsoft Defender for Cloud. Microsoft also recommended honeypots and decoy systems designed to attract attackers and help security teams detect suspicious activity.\n\n## Microsoft's Scale Across Cloud and Developer Platforms\n\nMicrosoft, founded in 1975 and headquartered in Redmond, develops and sells cloud computing through Azure, productivity software through Microsoft 365, AI assistants through Copilot, gaming through Xbox and developer platforms through GitHub, according to akta.pro [company records](https://akta.pro/company-data). The company reported quarterly revenue of $82.9 billion in Q2 FY2026, up 18% year-over-year, and its AI business surpassed a $37 billion annual revenue run rate with 123% year-over-year growth, driven by Azure AI services and Microsoft 365 Copilot adoption. Microsoft employs over 220,000 people globally.\n\n## Microsoft's Recent Product and Partner Moves\n\nMicrosoft is releasing native Linux versions of Autoruns and macOS versions of Process Explorer, with new features for existing non-Windows tools including Sysmon, Procmon, ProcDump and ZoomIt, Neowin reported. Microsoft is also retiring Office 365 A1 and the Student Use Benefit, with web sales ending November 5, 2026, partner sales ending May 1, 2027 and final retirement on January 1, 2028, according to Neowin. Scout Clean Energy's 183 MW Nimbus Wind Farm in Arkansas reached commercial operations, generating enough electricity for over 40,000 homes annually, GlobeNewswire reported.\n","publisher":{"name":"News for Agent","url":"https://newsforagent.com"}}