Microsoft Threat Intelligence said on November 5 that, in at least one case, it “observed an AI agent advance from scanning GitHub for secrets to exfiltrating data from Azure Key Vault in just five minutes” (Microsoft Security blog).
Microsoft says threat actors have used an agentic AI offensive framework since August 2026 to search public GitHub repositories for exposed credentials and AI service keys, then use them against the organizations they belong to. The post does not name the actor behind this activity.
Business Pill · LEAST PRIVILEGE
A short Business Engineer explainer on least privilege: giving an AI agent only the access its task needs. It teaches the general idea only and says nothing about Microsoft or this attack.
The key insight:Microsoft Threat Intelligence said on November 5 that, in at least one case, it observed an AI agent advance from scanning GitHub for secrets to exfiltrating data from Azure Key Vault in just five minutes.
Searching public code for leaked keys is an old technique. Microsoft says it “has historically been limited by the time required for human operators” to find repositories, review them and use what they find.
Agentic tooling such as ARTEX changes that, Microsoft says, by scanning many repositories faster and using agents to analyze the output and run follow-on attacks, “cutting down on the need for the threat actor to have hands-on-keyboard interactions throughout the attack chain”.
In a follow-on attack that began as early as October 28, Microsoft says an agentic framework used valid leaked or stolen application credentials to sign in to Microsoft Entra ID tenants. It says the agent “successfully conducted service principal sign-ins on dozens of associated applications across multiple tenants”.
Those included cases where a multitenant application credential was compromised at the vendor that owns the application and then used to reach multiple downstream tenants, the post says. Microsoft does not give a count of affected customers; it refers to “some impacted customers”.
Seconds from a failed Azure Resource Manager request to the start of the AI agent’s corrected retry, which succeeded, in one attack Microsoft described: about 28 seconds for Key Vault secret metadata, 60 for Azure SQL firewall rules and 80 for an Application Insights query. Data: Microsoft Threat Intelligence blog, 5 Nov 2026.
Why AI Keys Were the Target
Microsoft says the agents “repeatedly demonstrated a focus on credentials that provide access to AI services”, such as API keys for major AI providers and OAuth applications with access to Foundry Tools, previously Azure Cognitive Services.
It adds that the actor tried to validate stolen Azure resources, including compromised Azure AI services, and that the activity suggests it “might have attempted to abuse some of these compromised AI resources” for its wider operation.
Machine-Speed Troubleshooting
Microsoft describes the agent correcting its own failed cloud requests. A batch of Key Vault requests failed because it used the wrong API version; “Approximately 28 seconds after the first failed response”, a rerun with a supported version succeeded, the post says. Two similar retries followed failures after about 60 and 80 seconds.
Microsoft says these sequences are “consistent with adaptive troubleshooting”. It also warns that actors change IP addresses, user agents and other fingerprints, so blocking traffic by those traits “will not stop an attack by an AI agent, which will quickly change them”.
The Response Window, by Our Arithmetic
On October 21, Microsoft reported “multiple instances where the time from initial targeting to privileged access was less than 3 hours” in a separate ARTEX campaign, as we reported then. Its November 5 post gives five minutes from GitHub scanning to Key Vault exfiltration in one case.
The two figures measure different steps in different campaigns, so they are not a measured speed-up. Set side by side, five minutes is one thirty-sixth of three hours, by our arithmetic. Microsoft’s guidance is to treat any publicly exposed secret as already compromised.
What Microsoft Recommends
Microsoft tells organizations to scan their GitHub code for secrets, remove them and rotate any exposed keys. It says to treat exposed credentials as compromised “even if the original location has subsequently been edited or deleted”, because deleting the content does not invalidate the credential.
It also recommends limiting who can register applications, applying Conditional Access policies to workload identities, and enabling Defender for Cloud plans including Defender for Key Vault. It says honeypots, tarpits and “fake wins” can pull autonomous AI attacks away from real targets, and that in its testing these controls reduced attack traffic reaching real assets.
As we read the post, the cost of a leaked key now depends on how fast the attacker’s agent finds it, which Microsoft says needs far less hands-on-keyboard work from a human operator.
As we read it, AI service keys have become a target in their own right: Microsoft says the agents repeatedly focused on credentials that give access to AI services.
As we read Microsoft’s guidance, it shifts defence from blocking known fingerprints, which it says the agents change quickly, to rotating exposed secrets and watching behaviour.
Microsoft Threat Intelligence, 5 Nov 2026
“Organizations that find their secrets exposed in public repositories must assume that the exposed secrets and associated applications are compromised.”
Three Implications
FOR SECURITY TEAMSMicrosoft says to treat publicly exposed credentials as compromised even if the original location has been edited or deleted, and to rotate them immediately.
FOR SOFTWARE VENDORSMicrosoft describes a multitenant application credential compromised at the vendor that owns it and then used to reach multiple downstream tenants.
FOR AI PLATFORM BUYERSMicrosoft says the agents targeted API keys for major AI providers and OAuth applications with access to Foundry Tools.
The analysis describes a governance layer and says “It is where decisions are made about who gets access to frontier intelligence, under what conditions, and for which purposes.”
As we read it, a leaked AI service key is that access decision made by accident: Microsoft says the agents it tracked went after exactly those keys. The analysis does not discuss Microsoft’s findings or ARTEX.
What Is Not Established
Microsoft does not name the actor behind this activity, say how many organizations were affected, or say whether the five-minute case was typical. We could not verify its findings independently. This piece contains no attack steps and makes no forecast.
This Week In The AI Supercycle
The Great Convergence of Capital, Power, and Geopolitics
This week’s issue: for two years the AI build-out was priced as a supply story, and last week as a credit story. This week it was priced as a permission story, and the answer arrived as a cost, not a ban.
Microsoft says an AI agent went from scanning GitHub for leaked secrets to taking data from Azure Key Vault in five minutes in at least one case, and that the agents it tracked targeted keys to AI services. Its advice is to treat any exposed secret as compromised and rotate it at once.
A note on sourcing. Figures and quotations are from Microsoft Threat Intelligence’s blog post of 5 November 2026 and, for the October 21 figure, our earlier report on Microsoft’s ARTEX disclosure. We could not verify Microsoft’s findings independently. The ratio is our arithmetic. This piece is not security advice.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
