Microsoft observed threat actors using agentic tooling to find secrets exposed in public GitHub repositories and to move through Entra service principals into privileged Azure services. One reported chain moved from a discovered GitHub secret to Azure Key Vault exfiltration in about five minutes. The provider documented cloud API corrections but did not…
Inspect the ClaimsCase · DiggingBeagle record
Microsoft traces agentic cloud-secret abuse from GitHub into Azure Key Vault
Microsoft observed threat actors using agentic tooling to find secrets exposed in public GitHub repositories and to move through Entra service principals into privileged Azure services. One reported chain moved from a discovered GitHub secret to Azure Key Vault exfiltration in about five minutes.
Public disclosure: Nov 5, 2026
Scope
Reported incident or observed attacker activity; separate observed access from inferred downstream use and unverified victims.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- confirmed in the wild
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- WITH AI
Basis and provenance
production; confirmed in the wild. The cited primary disclosure supports the specific sequence and boundaries described here: Agentic tooling searches public GitHub repositories for secrets and selects usable application credentials. The evidence does not independently establish consequences beyond the record's supported outcome; a numerical impact band cannot be justified from the available evidence. Evidence grade B reflects the source attribution and independent verification limits.
Assessed Nov 7, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB07-007-OUTCOME · CLM-DB07-007-MECHANISM · CLM-ENR-DB07-006-CLOUD-PRINCIPAL-CHAIN · Microsoft Security: Threat actors use agentic AI tooling to find and abuse exposed secrets
At a glance
Revoke exposed service-principal credentials, narrow Key Vault roles and correlate GitHub secret discovery with actual Azure audit events. Todyl’s linked access observations add an independently logged downstream exposure dimension: roughly 45 app registrations, more than 33 successful app sign-ins, and access reaching 27 organizations through MSP…
Read the implicationsModel and human split unknown; no full public victim/loss counts; IP associations not proof all activity same group.
Limits and uncertaintyFull account
Microsoft observed threat actors using agentic tooling to find secrets exposed in public GitHub repositories and to move through Entra service principals into privileged Azure services.
One reported chain moved from a discovered GitHub secret to Azure Key Vault exfiltration in about five minutes. The provider documented cloud API corrections but did not determine which steps were model-autonomous versus manually directed.
The relevant AI contribution was not possession of some new cloud privilege; the leaked credentials already carried that authority. Microsoft's investigation instead shows agentic tooling finding secrets in public source repositories and rapidly using them to navigate Entra and Azure resources. Microsoft describes one five-minute transition from repository scanning to Key Vault data extraction. Its first-party cloud telemetry also records successful service-principal sign-ins on October 28 and misuse of multitenant vendor application credentials across downstream tenants. Those observations support an agent-assisted intrusion sequence, but they do not identify every model decision or establish that all reported IPs belonged to one operator. The defensive boundary is the credential's actual resource scope and where its use is logged, not whether GitHub content was publicly accessible.
The five-minute sequence is a chain of credential authority, not evidence that an AI model independently chose every step. A secret discovered in a public repository becomes consequential only when the associated Entra principal has usable permissions on downstream services, including Key Vault. Microsoft observed rapid corrections to failed cloud API calls, but those timings do not resolve the model-versus-operator division of labor. The relevant defense test combines repository-secret revocation, effective cloud role scope, and audit confirmation of which data the principal actually retrieved.
Mechanism and trust boundary
- 01
Agentic tooling searches public GitHub repositories for secrets and selects usable application credentials.
- 02
Actors authenticate as compromised Entra application/service principals, including cases of vendor-owned multitenant credentials.
- 03
Cloud API access reaches discovery, Key Vault or Storage extraction and other follow-on actions under the principal's granted roles.
Timeline
- Oct 28, 2026Event type unspecified
Compromised Entra application authentication observed
Microsoft records application or service-principal sign-ins in the incident group and describes secret-driven expansion to cloud resources.
- Nov 5, 2026Event type unspecified
Microsoft publishes actor activity analysis
First-party analysis documents rapid secret discovery and a roughly five-minute GitHub-to-Key-Vault extraction path.
- Nov 5, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB07-007-OUTCOMEOne reported chain moved from a discovered GitHub secret to Azure Key Vault exfiltration in about five minutes. The provider documented cloud API corrections but did not determine which steps were model-autonomous versus manually directed.supported
Basis: reported finding
- supportsMicrosoft Security: Threat actors use agentic AI tooling to find and abuse exposed secretsprimary disclosure
Campaign analysis; five-minute GitHub-to-Key-Vault chain; Entra cross-tenant access
CLM-DB07-007-MECHANISMMicrosoft observed threat actors using agentic tooling to find secrets exposed in public GitHub repositories and to move through Entra service principals into privileged Azure services.supported
Basis: reported finding
- supportsMicrosoft Security: Threat actors use agentic AI tooling to find and abuse exposed secretsprimary disclosure
Campaign analysis; five-minute GitHub-to-Key-Vault chain; Entra cross-tenant access
CLM-DB08-TODYL-MSP-DOWNSTREAM-ACCESSTodyl reported about 45 app registrations targeted across roughly 18 organizations, more than 33 successful app sign-ins, and access extending to 27 organizations through managed-service-provider relationships. Its November 6 update linked observed infrastructure to Microsoft’s ARTEX credential-harvesting report, without independently recording the model’s per-action decisions.supported
Basis: reported finding
- supportsTodyl: stolen app credentials, downstream MSP access and suspected agentic harvestingprimary disclosure
November 3, 4:36 p.m. MT update, What we are seeing; November 6, 1:19 p.m. MT update, Root cause and Microsoft correlation
CLM-ENR-DB07-006-CLOUD-PRINCIPAL-CHAINMicrosoft documented compromised Entra service principals and use of multitenant application credentials in campaigns where agentic tools located exposed secrets. The affected cloud scopes determined the resources that could be reached.supported
Basis: reported finding
- supportsMicrosoft Security: Threat actors use agentic AI tooling to find and abuse exposed secretsprimary disclosure
Service principals, cross-tenant access, and five-minute GitHub-to-Key-Vault sequence
Implications
Revoke exposed service-principal credentials, narrow Key Vault roles and correlate GitHub secret discovery with actual Azure audit events.
Todyl’s linked access observations add an independently logged downstream exposure dimension: roughly 45 app registrations, more than 33 successful app sign-ins, and access reaching 27 organizations through MSP relationships. Todyl counted 81 downloaded files and approximately 2,279 mailbox items accessed across its instrumented customers. Those are provider-scoped minima and distinct measures, not 27 confirmed ARTEX-autonomous intrusions. The overlapping Microsoft IP analysis strengthens campaign linkage but does not reconstruct each model decision.
Unknowns and contradictions
- Model and human split unknown; no full public victim/loss counts; IP associations not proof all activity same group.
Sources and citation
Material revision history
- Nov 7, 2026 · Published version · first publication · revision 227
- Nov 8, 2026 · Canonical change recorded · material revision · revision 228Public fields changed: claims, implications, references