Threat actors are using the agentic AI framework ARTEX to hunt exposed secrets on GitHub and turn them into cloud break-ins — in one case going from a public repository search to stealing data from an Azure Key Vault in five minutes, Microsoft Threat Intelligence reported on 5 November.

How the attacks work

Starting in August 2026, Microsoft observed the agents submitting large volumes of GitHub searches pairing a target organisation's name with keywords for secrets, cloud services and AI providers. The exposed material included application credentials and API keys for AI inference services. Once a useful secret was found, the agent signed in as that application's service principal, enumerated resources through Azure Resource Manager, and read whatever the role allowed, including Key Vault secrets and Storage accounts. It also searched Azure DevOps for more secrets and ran commands on virtual machines through Run Command.

An agent that fixes its own mistakes

The agents corrected their own errors. In one case a Key Vault request failed with an HTTP 400 error for using a data-plane API version; 28 seconds later the agent retried with ARM API version 2023-07-01 and got an HTTP 200. From 28 October, Microsoft saw successful service-principal sign-ins from the address 199.19.77.84 across dozens of applications in multiple tenants. One credential belonging to a vendor-owned multitenant application was used to reach downstream tenants. Security firm Todyl, which investigated the same activity under the name Key Eater, calls it ongoing.

What to do

Microsoft attributes the activity to no named group and stresses that no Microsoft vulnerability is involved: the secrets were exposed in public repositories. Its advice is to treat any publicly exposed secret as compromised even after the original commit is deleted, rotate affected keys, and block 199.19.77.84 for workload identities.