Microsoft Details Agentic AI Attacks Using Exposed Secrets to Access Cloud Resources

Nov 5, 2026 · Original article ↗

Summary

Microsoft reports that threat actors used agentic AI tooling to find exposed GitHub secrets and abuse application credentials across Azure and Microsoft 365; in one case, an agent moved from secret scanning to Azure Key Vault data exfiltration in five minutes.

Key points

Microsoft observed agentic AI frameworks submitting large volumes of GitHub queries for exposed credentials and secrets beginning in August 2026.
In one observed case, an AI agent progressed from searching GitHub for client secrets to exfiltrating Azure Key Vault data in five minutes.
From October 28, 2026, Microsoft observed successful service principal sign-ins using leaked or stolen application credentials, followed by cloud discovery and access to Azure and Microsoft 365 resources.
Observed activity included attempts to retrieve credentials, access SharePoint and OneDrive, search Azure DevOps for secrets, and enumerate cloud resources.
Microsoft documented agents adjusting API versions after failed Azure Resource Manager requests, then receiving successful responses.
Microsoft recommends revoking or rotating exposed credentials, reviewing identity and cloud audit logs, restricting service-principal permissions, and using managed identities where supported.

Article Details

Attack Vectors: An agentic AI framework searched public GitHub repositories at scale for exposed credentials, application secrets, and AI-service API keys, using organization names and service-related keywords in its queries.
Threat actors used valid leaked or stolen application credentials for service-principal sign-ins to Microsoft Entra ID tenants and connected Azure and Microsoft 365 resources.
Compromised applications were used to enumerate subscriptions, resource groups, permissions, AI deployments, and service configurations, and to search for content through Microsoft Graph API requests.
The activity accessed credentials and data from Azure Key Vault, Storage Accounts, App Service settings, and other cloud resources; Microsoft observed secret exfiltration and file downloads from SharePoint and OneDrive.
Compromised applications accessed mailbox items. In some cases, agents obtained a token for a single-tenant OAuth application and used it to enumerate additional cloud resources and search Azure DevOps for secrets.
Agents used Azure VM Run Command, which can run scripts on virtual machines, creating potential access to stored credentials and data or opportunities for persistence and lateral movement.
Microsoft observed operations from 65.87.223[.]26 with indications of vulnerability exploitation involving shell commands embedded in a user-agent, as well as attempts to obtain App Service authentication tokens; successful exploitation was not stated.
Microsoft observed reconnaissance from 157.22.126[.]128 targeting AI workloads deployed by victims on Azure AI services.
In one observed case, an AI agent progressed from searching GitHub for client secrets to exfiltrating Azure Key Vault data in five minutes.
Some Azure Resource Manager requests that initially failed were retried with changed HTTP methods or supported API versions and then returned HTTP 200 responses.
Defensive Notes: Scan public repositories for exposed secrets, remove disclosures, and immediately revoke or rotate the affected credentials; deleting the exposed code alone does not invalidate credentials or remove retained copies.
Block 199.19.77[.]84/32 in the recommended Conditional Access policies for workload identities and users; Microsoft advises blocking the exact IP rather than its entire ASN.
For affected applications, remove client secrets, certificates, and federated credentials, and disable the service principal if needed. Revoke affected sessions and rotate credentials stored in accessible Key Vaults or documents.
Review Entra sign-in and audit logs, Azure Activity and resource diagnostics, Azure DevOps audits, and Microsoft 365 unified audit logs for suspicious sign-ins, secret reads, downloads, application or permission changes, and unfamiliar user agents.
Investigate behavioral patterns as well as IP addresses, including one source authenticating to multiple service principals or one application requesting tokens across Azure Resource Manager, Key Vault, Storage, and Graph in a short period.
Prefer managed identities over long-lived application client secrets, enforce least privilege for workload identities, and restrict who can register applications.
Enable public secret monitoring and push protection where available, and use relevant Microsoft Defender for Cloud protections for critical Azure workloads.
Use honeypots, decoys, tarpits, and fake wins to divert autonomous agents from legitimate assets and generate detection signals.

Indicators of compromise

Type	Indicator	Context
IPV4	`157[.]22[.]126[.]128`	Source of reconnaissance operations observed by Microsoft targeting victims' AI workloads on Azure.
IPV4	`199[.]19[.]77[.]18`	Observed as a source of service-principal sign-ins in the activity; Microsoft notes it is a Tor exit node that may also be associated with unrelated activity.
IPV4	`199[.]19[.]77[.]84`	Source IP observed for service-principal sign-ins and other activity attributed by Microsoft to the credential-abuse campaign.
IPV4	`65[.]87[.]223[.]26`	Microsoft identified malicious operations from this IP, including indications of vulnerability exploitation and attempts to obtain App Service authentication tokens.