ARTEX AI GitHub Secrets Attack: Microsoft Says an AI Agent Went From Leaked Keys to Azure Key Vault Data in Five Minutes, What Is Confirmed and What to Do

Microsoft says attackers are using an AI agent framework called ARTEX to search public GitHub code for cloud keys and app secrets. In one case it went from a GitHub search to pulling data out of Azure Key Vault in about five minutes. If anyone on your team, or any contractor, has ever committed a secret to a repository, assume it can be found and used faster than a person could react.

What happened with ARTEX and GitHub secrets

On Thursday, November 5, 2026, Microsoft Threat Intelligence and Microsoft Security Research published a report titled "Threat actors use agentic AI tooling to find and abuse exposed secrets." Microsoft says that starting in August 2026, threat actors used an agentic AI offensive framework to send large volumes of GitHub searches for exposed secrets. The searches often combined a target organization's name, secret-related keywords, and the names of cloud or AI services.

Microsoft names the framework ARTEX. By default it drives ordinary tools such as Nmap, curl, wget, Python HTTP clients and headless Chromium through Playwright. None of those tools are new. What matters, according to Microsoft, is speed: attackers can scan faster and carry out follow-on steps with less hands-on work.

What is confirmed

From Microsoft's report:

• Five minutes, one case. An AI agent went from searching GitHub for client secrets to exfiltrating data from Azure Key Vault in five minutes. Microsoft gives the start and end of that case, not every step in between. It is one documented case, not an average.
• Signing in as apps. From October 28, 2026, the framework used leaked or stolen application credentials to sign in as service principals (the accounts that apps use) in several Microsoft Entra ID tenants. Microsoft says it signed in on "dozens of associated applications across multiple tenants" and reached connected resources including SharePoint, OneDrive and Microsoft Graph.
• It fixed its own mistakes. A first batch of Key Vault requests failed with an HTTP 400 error because it used the wrong API version. About 28 seconds after that failure, a batch rerun against the same Key Vault paths, using a different API version, returned HTTP 200, meaning success.
• What it did with access. Using tokens for single-tenant OAuth apps, the agents listed resources, read Key Vault secrets, searched Azure DevOps and used Azure VM Run Command, which runs commands on virtual machines. Microsoft says they focused heavily on AI service credentials.

From Todyl, a security company whose report Microsoft links as a similar campaign involving the same IP addresses:

• Todyl published on November 3, 2026 and updated on November 6. Its first sighting of access with a stolen app credential was November 1 at 08:45 UTC.
• About 45 app registrations were targeted, more than 33 authenticated successfully, and the actor had reached 27 organizations so far. Todyl says these numbers are a floor because they cover only organizations that send it logs.
• Todyl reports about 2,279 mailbox items accessed, 81 files downloaded from SharePoint at roughly one per second, and two users' Azure DevOps session tokens replayed on November 2.
• In Todyl's words: "We've seen no extortion demand, encryption or destruction, but data was accessed."

Why MSP clients should pay attention

Todyl's report shows the access spreading through managed service providers (MSPs). The stolen credentials included integration apps for security tools, among them Todyl's own integration apps in two MSP tenants. One MSP's app obtained a Partner Center token, and that MSP's GDAP automation app was tried against client tenants without success. A single multi-tenant app swept 15 client tenants in loops of about 10 seconds.

Todyl lists the affected downstream clients as being "in government, energy, food and agriculture, transportation, construction and engineering, legal, education and nonprofits."

If an outside provider runs your IT, their app credentials can be a path into your Microsoft 365 and Azure tenant. Ask them directly whether any of their apps were in scope.

What is not known

• Who built ARTEX, and whether it is publicly available. Microsoft does not say.
• Who is behind the secret scanning. Microsoft's report does not attribute it to a named group or country. Todyl's first version gave an AI-driven origin low confidence. Its November 6 update attributes the root cause to an agentic credential crawler, citing Microsoft's research.
• How many victims there are in total. Microsoft gives no total. Todyl's counts cover only its own customers.
• Whether secrets were read everywhere tokens were requested. Todyl notes that Key Vault audit logs are needed to confirm secret reads.

How to check for leaked secrets: what to do this week

Why this matters for a business network or website

The code behind a website or app often holds the keys to everything around it: the database, the email service, cloud storage and AI services. A key gets pasted into a config file for a quick test, the repository is made public, or a contractor copies it into their own account. Microsoft's report shows that an automated agent searching for your company's name can find that key and act on it within minutes.

The Todyl findings also show that stolen sessions, not only passwords, were replayed. Our post on Device Bound Session Credentials explains how stolen session cookies can be made useless. If you run your own servers and apps, keeping keys out of code is part of self-hosting infrastructure done properly.

ARTEX AI questions people are asking

What is ARTEX AI?

Microsoft describes ARTEX as an agentic AI offensive framework: an AI agent that runs common scanning and hacking tools on its own. Microsoft does not say who made it.

Did ARTEX hack GitHub?

No. Microsoft describes attackers searching public GitHub content for secrets that people had committed. GitHub itself is not described as breached.

Was Azure Key Vault hacked?

No flaw in Key Vault is described. The attackers used real application credentials that had leaked or been stolen, so they could read what those credentials were allowed to read.

Is deleting the commit enough?

No. Microsoft says to rotate or revoke exposed credentials even if the original copy was deleted, and GitHub says to rotate the affected credential immediately.

Does this matter if we do not use Azure?

Microsoft's report covers Azure and Microsoft 365. The method, searching public code for keys, works against any service whose keys end up in a repository, so the same checks are worth doing.

How fast can a leaked key be used?

In the one case Microsoft documented, five minutes passed between the GitHub search and data leaving Key Vault.

The bigger lesson

A secret in code is a published secret. When an agent can search and act within minutes, assume any leaked key has already been tried. Replace long-lived keys with managed identities where you can, and rotate the moment one escapes.

Want your code and cloud accounts checked for exposed secrets? See security hardening or get a quote.

Get security alerts like this by email, with our free checklist, at /security-alerts.

Sources: Microsoft Security Blog: Threat actors use agentic AI tooling to find and abuse exposed secrets; Todyl: Stolen App Credentials, Real Access; GitHub Docs: Secret scanning; GitHub Docs: Push protection.