Threat actors use agentic AI tooling to find and abuse exposed secrets

As cited

Copy frozen at 2026-11-06 02:59 UTC (site build).

threat intel

Threat actors use agentic AI tooling to find and abuse exposed secrets

Microsoft Threat Intelligence observed threat actors deploying an agentic artificial intelligence (AI) offensive framework to scan public GitHub repositories for exposed secrets, credentials, and application programming interface (API) keys, then using those credentials to compromise cloud infrastructure. In one documented case, an AI agent progressed from discovering credentials on GitHub to exfiltrating data from Azure Key Vault in five minutes. Attackers subsequently abused stolen application credentials to access Microsoft Entra ID tenants, enumerate resources across Azure and Microsoft 365, and target AI services for further compromise.

Why it matters: Organizations using GitHub and Azure are at immediate risk if secrets are exposed in public repositories; threat actors are now automating the discovery and exploitation of those credentials at machine speed, bypassing the manual effort that previously limited such attacks. Security teams must assume any exposed secrets are compromised, immediately rotate credentials from affected applications and key vaults, and implement detection rules to identify service principal sign-ins from the documented malicious IP addresses (199.19.77.84 and 199.19.77.18) and behavioral patterns of agentic AI scanning.

Source published

2026-11-05 23:46 UTC

First seen by Cybersecurity Tracker

2026-11-06 02:00 UTC