Agentic AI Offensive Framework Attacks Steal Cloud Keys
TL;DR
Microsoft researchers discovered that threat actors are running an agentic AI offensive framework to locate exposed credentials in public GitHub repositories. In one observed case, an autonomous tool moved from scanning code to stealing data from Azure Key Vault in just five minutes. Furthermore, these automated tools execute follow-on identity abuse across multiple cloud environments without manual intervention.
What Happened During the Intrusions
Starting in August 2026, Microsoft detected attackers submitting high volumes of search queries to public code repositories. According to an advisory detailing threat actors using agentic AI tooling by Microsoft Threat Intelligence, the operators searched for organization names alongside cloud credentials. When developers accidentally commit secrets to GitHub, autonomous systems locate the keys immediately.
“In at least one case, Microsoft observed an AI agent advance from scanning GitHub for secrets to exfiltrating data from Azure Key Vault in just five minutes,” Microsoft noted. Furthermore, the agentic AI offensive framework attacks extended to valid service principal credentials on October 28, 2026. Attackers connected from IP address 199.19.77.84 to access corporate Microsoft Entra ID tenants. Consequently, the intruders abused vendor-owned multitenant applications to compromise downstream client systems.
Adaptive Cloud Exploitation
During the intrusions, the autonomous tools demonstrated flexible problem-solving capabilities. When Azure Resource Manager rejected requests with HTTP 400 errors, the tools adjusted their parameters automatically. For example, after an initial failure enumerating Key Vault secrets, the agent switched to API version 2023-07-01 within 28 seconds. This adjustment returned an immediate HTTP 200 success response.
Additionally, the attackers performed similar automated corrections against Azure SQL servers and Application Insights endpoints within 80 seconds. Meanwhile, investigators detected malicious operations from IP address 65.87.223.26, which injected shell commands to harvest App Service tokens. Independent security vendor Todyl confirmed matching activity originating from the same network addresses.
Who Is Behind the Activity
Microsoft has not attributed these attacks to a named state-sponsored or cybercrime group. However, analysts confirm that operators rely on an agentic AI offensive framework such as ARTEX. “This activity illustrates an ongoing trend of threat actors accelerating all stages of the attack chain with agentic AI penetration testing frameworks, including ARTEX,” the report explained.
Earlier threat reports from CrowdStrike also documented ARTEX in espionage operations against global targets. In this campaign, operators used open-source components alongside commercial language model subscriptions to manage their scanning pipelines. Therefore, small groups can run broad reconnaissance operations that previously required extensive manual staffing.
Impact and Cloud Resource Abuse
The attackers concentrated heavily on tokens that provide access to artificial intelligence infrastructure. Specifically, the tools targeted API keys for external model providers and permissions for Azure AI Foundry tools. In some compromised tenants, the actors attempted to run their own workloads on victim-funded computing resources.
Moreover, the agents abused OAuth permissions to execute scripts on virtual machines through the Azure Run Command feature. Compromised applications also accessed corporate SharePoint sites and OneDrive file repositories. “Publicly exposed credentials remain usable until revoked or rotated; removing the original disclosure alone does not remediate the exposure,” Microsoft warned.
How Organizations Can Stay Protected
To defend against an agentic AI offensive framework, organizations must eliminate hardcoded credentials across all software repositories. Security teams should enable automated secret scanning and push protection in GitHub Advanced Security. These tools block sensitive commits before code reaches public servers.
Furthermore, administrators should transition cloud workloads to managed identities. “While storing long-lived application client secrets in code is a common practice, using managed identities for application authentication eliminates the possibility of secret exposure in code,” Microsoft advised. Finally, defenders must audit Entra ID sign-in logs for unexpected service principal activity from IP address 199.19.77.84 and revoke any exposed credentials immediately.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
