Agentic AI exposed secrets attacks pair an AI agent with a credential that someone left in public code. Microsoft Threat Intelligence reports that attackers used the agentic framework ARTEX to search GitHub for such secrets and then act on them. Censys counted more than 1,400 exposed ARTEX consoles in early November 2026. This explainer covers how the pattern works and what defenders change.
What Are Agentic AI Exposed Secrets Attacks?
A secret is any value that proves identity to a system: a password, an API key, an application client secret or a connection string. An exposed secret is one that sits in a place others can read, such as a public code repository. Anyone who finds it can sign in as the application that owns it.
Searching public code for secrets is not new. Microsoft calls it a well-documented technique that was limited by the time humans need to find repositories, read them and use what they find. An agentic tool removes that limit. It scans more repositories, reads the output itself and moves on to follow-on actions with little hands-on-keyboard work.
ARTEX is such a tool. Our ARTEX profile explains the framework and the groups reported using it. Here the focus is narrower: what happens to a leaked secret once an agent finds it.
How Does an Agent Turn a Leaked Secret Into Cloud Access?
Microsoft says that from August 2026 it saw an agentic framework send large volumes of queries to GitHub. The queries often held a target organization’s name, a keyword for secrets, a keyword for a cloud service or a keyword for another AI provider. The diagram follows the chain Microsoft describes.
- Agent queries GitHub for secretsPublic codequeries name the target, secrets and cloud keywords
- A client secret is found in a repositoryPublic codestill valid until revoked or rotated
- Service principal signs inIdentityvalid credential, so the sign-in succeeds
- Agent maps subscriptions and AI deploymentsIdentityenumerates resources and permissions
- Key Vault, storage and Microsoft 365 data readCloud datasecrets, files and mail items exfiltrated
- Credentials and AI services abusedCloud data
Microsoft reports at least one case in which an agent went from scanning GitHub for secrets to exfiltrating data from Azure Key Vault in five minutes. Follow-on sign-ins began as early as 28 October 2026 and covered dozens of applications across multiple tenants. In one case a multitenant credential was compromised at the vendor that owned the application and then used against downstream tenants.
What Did the Agents Do Once They Were In?
Microsoft says the agents requested credentials such as storage account keys, App Service settings and connection strings. They reached SharePoint and OneDrive, downloaded files and accessed mailbox items. They also listed subscriptions, permissions and AI model deployments to map the environment.
Two details matter for defenders. First, when a cloud request failed, the agents changed the call and retried, in some cases succeeding within about a minute. Second, they showed a clear interest in credentials for AI services, and Microsoft says some compromised Azure AI resources may have been used to support the wider attack.
What Did Censys Count?
Censys published its ARTEX analysis on 5 November 2026. It says ARTEX is an open-source, LLM-driven autonomous penetration testing framework released in July 2026. Censys notes that not every exposed instance is malicious, because authorized testers also run it.
- Exposed consoles.
- 1,465 hosts with an exposed ARTEX console as of 4 November 2026.
- Distinct deployments.
- About 650 hosts sit in two blocks of identically configured hosting, leaving roughly 815 distinct-looking deployments.
- Other threats on the same hosts.
- 155 hosts (10.6%) also run at least one other threat Censys detects, such as other AI attack frameworks, Cobalt Strike, Vshell or Adaptix C2.
- Open directories.
- 32 open directories on ARTEX hosts, exposing tools such as stagers and implants.
- LLM gateways.
- 43 ARTEX hosts also run LLM gateway or reseller software.
- Global total.
- Censys says overall deployment is likely higher.
The count describes attacker-side and tester-side tooling, not victims. Censys also reports that operators often leave directories open, which is how a CrowdStrike investigation found one operator. It advises defenders to look for unfamiliar LLM proxies and resellers in egress logs.
What Changes for Defenders?
Microsoft’s advice starts with the secret itself. Remove it from the code, rotate it and treat it as compromised, because deleting a file does not cancel a credential. Copies can remain in edit history, caches, archives and logs.
The steps below mix Microsoft’s recommendations with our own advice. Where a step is ours, it says so.
- Find exposed secretsScan your own repositories and turn on GitHub public monitoring to catch secrets leaked in other public repositories. Push protection blocks supported secrets before they are pushed.
- Rotate first, investigate secondRevoke or rotate any exposed credential, then review its history of use. Remove the secret, not just the file.
- Hunt in sign-in logsMicrosoft says the errors AADSTS7000215 and AADSTS7000222 show someone holding a credential for your app. A failure followed by a success is urgent.
- Watch behavior, not addressesAttackers change IP addresses and user agents easily. Microsoft suggests signals such as one address signing in to three or more service principals.
- Remove long-lived secretsUse managed identities instead of client secrets where possible, and apply least privilege to service principals.
- Check vendor-owned apps (ours)List the vendor applications that hold credentials in your tenant, and ask each vendor how it protects them.
Microsoft also describes honeypots, decoys and tarpits as a way to pull agents away from real assets. In its testing these controls reduced attack traffic reaching real assets. Our agentic security page covers the wider picture.
What Does It Mean for Your Programme?
Our reading is that exposure time is the number to watch. An agent can act within minutes of a secret appearing in public code. A rotation process that takes days now leaves a long window.
The same tooling shows up in other incidents we have covered. See our posts on the VAPOR PANDA ARTEX campaign and on agentic AI in offensive attacks.