Microsoft says it has observed threat actors using an agentic offensive framework to search public GitHub repositories for exposed credentials, application secrets and AI service keys, then use the results in follow-on cloud attacks. In one observed case, an AI agent moved from searching for a client secret to exfiltrating data from Azure Key Vault within five minutes.
The company’s researchers linked the activity to valid application credentials used against Microsoft Entra ID, Azure and Microsoft 365 resources. They also described request sequences in which failed cloud API calls were quickly retried with corrected methods or versions, behaviour that Microsoft assessed as adaptive troubleshooting by the tooling. The reporting does not show that every exposed secret led to compromise, but it demonstrates how automation can compress reconnaissance, validation and exploitation.
The practical lesson is that deleting a secret from a repository does not neutralise it. Organisations must rotate exposed credentials, review service-principal sign-ins and activity logs, and assume that public secrets may already have been collected. Managed identities, short-lived credentials and least-privilege access reduce the usefulness of material that does escape.
Microsoft’s observations are vendor threat intelligence, not an independent census of attacks. Even so, the detailed indicators and mitigation steps make the disclosure operationally useful.
