Hackers using the agentic AI framework known as ARTEX have managed to exploit public GitHub repositories to steal Azure Key Vault secrets in as little as five minutes. Microsoft’s recent threat intelligence reveals a campaign where ARTEX detects exposed credentials in public code and uses them to take control of cloud resources almost instantly. These credentials included passwords, AI API keys, and access tokens.
From Exposure to Exploitation
What used to require manual effort—developers accidentally committing secrets, then manually discovering and verifying them—is now automated. ARTEX’s AI agents scan public GitHub repos, parse code to identify secrets and cloud-service references, and subsequently test whether those credentials grant access to target cloud environments. By August 2026, threat actors started launching large-scale GitHub queries containing both company names and cloud– or AI-specific terms. Their goal: uncover keys or secrets left exposed in code.
Attack Flow and Real-World Impacts
A typical ARTEX attack sequence kicks off with scanning GitHub for exposed credentials, often including service principals’ secrets or AI service keys. In one documented case, Microsoft observed a successful service principal sign-in from an IP address in late October 2026, giving attackers access across multiple application IDs. Once inside, the actors enumerated subscriptions, resource groups, AI deployments—and probed for credentials across storage, Kubernetes, connection strings, and App Service settings. When initial access failed, the agents quickly pivoted, switching API versions or methods. One attack retried a Key Vault access request 28 seconds after an HTTP 400 error—this time succeeding.
Additional observation showed ARTEX agents using Azure Run Command to execute scripts on virtual machines, likely to extract stored credentials or establish persistent access. Shared data accessed by compromised resources included files from OneDrive and SharePoint, harvested via the Microsoft Graph API. Security firm Todyl estimates the campaign affected roughly 27 organizations—including customers of managed service providers—downloading dozens of files and accessing thousands of mailbox items.
Mitigation & What Organizations Should Do Now
Microsoft emphasizes that once credentials are published—even if deleted—they should be considered compromised. Repositories, edit history, and caches may still retain those secrets. The recommended response is to rotate keys immediately and investigate their past usage. Secret scanning tools such as GitHub’s built-in features detect leaks even in full history; Azure DevOps provides push protection to stop secrets before Code gets committed.
Other mitigation strategies include transitioning away from client secrets in favor of managed identities, applying least-privilege permissions to service principals, and deploying Conditional Access policies for workload identities—particularly to block IP addresses tied to recent attacks. Monitoring non-interactive logins, especially sequences where failed logins are followed by successful ones, and alerting on apps requesting tokens across multiple services in a short window, can help identify intrusions early. Setting up honeypots or decoy systems may also redirect AI agents toward non-critical targets and provide early warnings.
Industries relying heavily on public code hosting and large cloud footprints are most at risk. With attack tools like ARTEX now automating credential theft across GitHub and leveraging exposed secrets for Azure Key Vault intrusions, the traditional perimeter is no longer the primary vulnerability. Organizations must treat any past public exposure of secrets as a breach. Continuous secret hygiene, comprehensive scanning, and architectural shifts toward identity-based access are now essential defensive measures. The speed at which these AI agents move—from discovery to compromise—leaves almost no margin for delayed responses. Vigilance and robust controls will make all the difference.
