Microsoft says threat actors are using AI agents to search public GitHub repositories for exposed credentials, then use those credentials to access cloud resources. In one case, the company observed an agent progress from searching GitHub for client secrets to exfiltrating data from Azure Key Vault in five minutes.
Microsoft began observing large volumes of these searches in August 2026. According to the company, the agents queried GitHub using terms tied to target organizations, secrets, cloud services and AI service providers. The tools could analyze search results and carry out further attacks with less direct input from an operator.
Stolen credentials opened access to cloud services
In an attack that began as early as October 28, Microsoft says an agentic framework used valid leaked or stolen application credentials to access Microsoft Entra ID tenants at certain organizations, along with connected Azure and Microsoft 365 resources. It recorded successful sign-ins for dozens of applications across multiple tenants.
Some affected customers had a multitenant application credential compromised at its source, a vendor-owned application. Microsoft says the attackers then used that credential to reach downstream tenants. Service principals, the identities applications use to authenticate, gave the attackers access to resources the applications were authorized to use.
Read nextGoogle reports LLM access theft that drove cloud bills above $1 millionThe attackers sought storage account keys, application settings and other credentials. Microsoft also observed access to SharePoint and OneDrive, including file downloads and mailbox-item access. In some tenants, the attackers searched through Microsoft Graph API requests. They also mapped Azure subscriptions, permissions and AI model deployments.
Microsoft says the agents repeatedly focused on credentials for AI services. It observed attempts to validate stolen Azure resources, including compromised Azure AI services, and says the activity suggests the attackers might have tried to use some of those resources in the wider attack.
Microsoft urges organizations to rotate exposed secrets
Microsoft advises organizations to scan their code and check for secrets exposed in public repositories. It says removing a secret from code is insufficient because the credential remains usable until it is revoked or rotated. GitHub’s public monitoring can also help organizations find secrets leaked in repositories they do not own.
For organizations that find exposed secrets, Microsoft recommends removing them from the codebase and immediately rotating the affected keys or credentials.
