Microsoft says threat actors used agentic AI tools to search public GitHub repositories for exposed credentials, then use them to access cloud resources. In one case, the company says, an agent moved from searching for secrets to taking data from Azure Key Vault in five minutes. That is a sharp reminder that a leaked key is not merely untidy code: it can be a working door.
Microsoft AI Watch analysis
What happened
Microsoft Threat Intelligence says the activity began as early as August 2026, with automated searches for credentials and keys in public repositories. The company describes agents analysing search results and carrying out follow-on actions, including attempts to access Microsoft Entra ID tenants and connected Azure and Microsoft 365 resources.
Microsoft says exposed credentials were used for cloud discovery and, in some cases, data access or exfiltration. Its threat-intelligence account describes one observed five-minute path from GitHub searches to Azure Key Vault. These are Microsoft’s observations of activity affecting some organisations, not evidence that every exposed secret has been exploited.
Why it matters
The practical danger is the speed from discovery to access. A credential committed to a public repository may remain usable even after the file is deleted, so Microsoft advises affected organisations to revoke or rotate exposed keys and credentials. It also recommends scanning code, enabling secret monitoring and reviewing access and activity logs.
That makes secret management a live security control, not a housekeeping job for a quieter Friday. For organisations using cloud applications, the question is not only whether a secret has leaked, but what it could reach before anyone notices.
Our read
Agentic tooling does not make credential theft a new species of attack, but it can shorten the time between finding a key and using it. Microsoft’s account is a useful warning because it includes a concrete example and steps defenders can take, while the reported activity remains the company’s account of what it observed. If a credential has been exposed, deleting the line of code is not the same as closing the door.
What to watch
- Whether Microsoft or other security researchers publish further detail on the affected activity. – Whether organisations review exposed credentials and rotate any that could still grant access. – Whether future reporting shows how widely agentic tools are being used in credential-focused attacks.
Discussion spark: Should organisations treat any credential exposed in a public code repository as compromised by default, even when there is no sign it has been used?
Sources and evidence
- Threat actors use agentic AI tooling to find and abuse exposed secrets – Microsoft (5 November 2026, 23:46 UTC)
- Your request has been blocked. This could be due to several reasons. (5 November 2026, 23:46 UTC)
not affiliated with or endorsed by Microsoft