ARTEX Agentic Secret Harvesting 2026: How AI Agents Turned Leaked GitHub Secrets into Key Vault Theft

On 5 November 2026, Microsoft Threat Intelligence reported that threat actors were using ARTEX, an agentic offensive AI framework, to search public GitHub repositories for leaked application secrets, OAuth client secrets and AI service API keys, then use them inside the victims' cloud tenants. Microsoft says it saw the framework submitting large volumes of GitHub queries from August 2026, often combining organisation names with keywords for secrets and cloud or AI providers. From 28 October 2026, agents signed in as service principals on dozens of applications across multiple tenants, including a vendor-owned multitenant app used against downstream customers. They hunted for operations that return credentials, enumerated Azure Key Vault secrets and, in one case, went from a secret found on GitHub to exfiltrating Key Vault data in five minutes. Microsoft has not named the affected organisations. It recommends removing exposed app credentials, rotating every secret the apps could reach and moving to managed identities.

At a glance

What happened

ARTEX is a multi-agent AI penetration-testing framework. BleepingComputer reports that it was first released as open source and later made proprietary after it was used in real attacks. By default it drives common tools such as Nmap, curl, wget, Python HTTP clients and headless Chromium through Playwright, according to Microsoft. That lets an operator hand a goal to a set of agents and have them carry out reconnaissance, analysis and follow-on actions with little manual work. Microsoft had already linked ARTEX to Storm-0940's supply chain compromise involving ConnectWise, covered on our ConnectWise Cloud Backup breach page.

In its 5 November 2026 post, Microsoft Threat Intelligence and Microsoft Security Research describe a broader pattern. From August 2026, the framework sent large volumes of GitHub search queries, often naming target organisations alongside keywords for secrets, cloud services or AI providers. Where it found working credentials, agents used them. Microsoft observed service principal sign-ins from two IP addresses, one a Tor exit node, starting on 28 October 2026, across multiple application IDs and tenants. In one case a vendor-owned multitenant application was compromised and then used against downstream tenants, the same shape of attack seen at ConnectWise.

Once signed in, the agents went after operations that hand back more credentials: storage account keys, App Service settings, connection strings, publishing credentials, AI and machine learning connections and AKS user credentials. They enumerated subscriptions, resource groups, permissions and AI model deployments, sent Microsoft Graph searches across SharePoint, OneDrive and mailboxes, used OAuth applications to search Azure DevOps for more secrets, and used VM Run Command. Microsoft says the agents adapted when calls failed: Key Vault enumeration first used a data-plane API version against the control plane, then succeeded with an Azure Resource Manager API version. In some cases they exfiltrated Key Vault secrets and Storage Account data. The Cloud Security Alliance's 9 November briefing summarised the headline case: "Microsoft saw an ARTEX agent go from a leaked GitHub secret to Azure Key Vault exfiltration in five minutes."

Microsoft also notes a focus on AI service credentials, including API keys and OAuth apps with access to Foundry Tools, formerly Azure Cognitive Services, and says the agents tried to validate stolen Azure AI resources and may have abused them. Microsoft has not named victims or said how many organisations were affected. It has not attributed this activity to Vapor Panda, the China-linked group CrowdStrike says used ARTEX in a separate campaign, so the two are covered on separate pages.

Timeline

How it happened: the identity attack path

1. Automated secret discovery. ARTEX agents searched public GitHub repositories for client secrets, application secrets and AI API keys, targeting named organisations.
2. Service principal sign-in. Valid client secrets let agents authenticate as the applications' service principals, from anonymising infrastructure including a Tor exit node, across multiple tenants.
3. Multitenant amplification. In at least one case, a vendor-owned multitenant app's credentials were used against downstream customer tenants.
4. Credential harvesting inside the tenant. Agents called operations that return further secrets, such as storage keys, connection strings, publishing credentials and AKS credentials, and searched Azure DevOps, SharePoint, OneDrive and mail for more.
5. Adaptive Key Vault access. When API calls failed, agents changed API versions or HTTP methods until they succeeded, then enumerated and in some cases exfiltrated Key Vault secrets.
6. Exfiltration and AI resource abuse. Agents took Key Vault secrets and Storage Account data and tried to validate stolen Azure AI resources, which Microsoft says may have been abused.

Impact

• Confirmed by Microsoft: service principal sign-ins with leaked secrets across dozens of applications in multiple tenants, exfiltration of Key Vault secrets and Storage Account data in some cases, and searching of Microsoft 365 content and Azure DevOps.
• Possible: abuse of stolen Azure AI resources, and persistence or lateral movement through VM Run Command, which Microsoft says could expose stored credentials.
• Undisclosed: the names and number of affected organisations, the volume of data taken and the operators behind this activity.
• Wider: the use of a vendor's multitenant app against its customers means one leaked secret can become an incident for many organisations at once.

What this means for NHI and AI agent security

This campaign is almost entirely about non-human identities. The entry point is a leaked application secret, the identity used is a service principal, the targets are more secrets, and the prize is Key Vault. What changes with ARTEX is speed and persistence. An agent that retries with a different API version within seconds, and moves from discovery to exfiltration in five minutes, removes the window many teams rely on between a secret leaking and someone noticing. Microsoft's own advice is clear that removing a secret from a repository does not invalidate it.

The practical answer is to make leaked secrets worthless. Managed identities and federated, short-lived credentials remove the static client secret that a GitHub search can find. Where secrets remain, app management policies can cap their lifetime, and push protection can stop them reaching public repositories. Workload identity Conditional Access and detection of unusual service principal sign-ins give a chance to stop the use of a secret that slips through. Our Azure RBAC and Service Principals Guide, Cloud Workload Identity Guide and Leaked secret breaches lessons cover these controls. The same agent-driven pace shows up in the GitBook breach and the Claude Code settings leak, where secrets landed in public repositories in the first place.

Recommendations

• Revoke leaked app credentials at the app. For any affected application, remove all client secrets, certificates and federated credentials and disable the service principal if needed, then rotate everything in any Key Vault the app could read. See our Azure RBAC and Service Principals Guide.
• Replace client secrets with managed identities. Move OAuth apps and workloads from secret-based authentication to managed identities or workload identity federation, so there is nothing static to leak. See our Cloud Workload Identity Guide.
• Stop secrets reaching public repositories. Enable secret scanning and push protection, and treat any secret ever committed as compromised. See How to enable GitHub secret scanning push protection.
• Cap secret lifetimes and app creation. Use app management policies to restrict password credentials and set maximum lifetimes, and limit who can register applications.
• Hunt service principal sign-ins. Review service principal and non-interactive sign-in logs for Microsoft's indicator addresses, including failures; a failure followed by a success is urgent. See our ITDR Guide.
• Apply least privilege to service principals. Remove Key Vault, storage key and publishing credential permissions that applications do not need, and protect backup and recovery resources.
• Consider decoys. Microsoft says honeypots, decoys and tarpits reduced attack traffic reaching real assets in its testing; canary secrets give early warning when automated scanners find them. See our Deception Technology Guide.

Frequently asked questions

What is ARTEX?

ARTEX is a multi-agent AI penetration-testing framework that lets an operator direct AI agents to carry out reconnaissance, exploitation and follow-on actions with little manual work. BleepingComputer reports it was first released as open source and later made proprietary after real-world misuse. Microsoft, CrowdStrike and Zscaler have all reported its use by threat actors in 2026.

How did AI agents get into Azure Key Vault?

According to Microsoft, agents found application and OAuth client secrets leaked in public GitHub repositories, used them to sign in as the applications' service principals, enumerated Key Vault secret metadata and, when an API call failed, switched API versions until it worked. In some cases they then exfiltrated the secrets. In one case the whole sequence took five minutes.

Is this the same campaign as Vapor Panda?

Not as far as published sources show. Microsoft has not attributed this secret-harvesting activity to a named group, while CrowdStrike reported that the China-linked actor Vapor Panda used ARTEX against more than 200 organisations. Both involve the same framework, and Microsoft separately ties ARTEX to Storm-0940 and Storm-3358, which suggests several actors are using it.

Related NHI Mgmt Group resources

Vapor Panda ARTEX campaign 2026 · ConnectWise Cloud Backup breach 2026 · Claude Code settings leak 2026 · Azure RBAC and Service Principals Guide · Leaked secret breaches

How NHI Mgmt Group can help

Agentic frameworks such as ARTEX turn every leaked client secret into an attack that can finish in minutes. NHI Mgmt Group helps teams find the service principals, OAuth apps and secrets in their tenants, retire static credentials in favour of managed and federated identities, and set up detection for machine sign-ins that do not fit. Our training covers secrets management, workload identity and the defensive response to AI-driven attacks. See our NHI and AI agent security training.

References

• BleepingComputer: Chinese hackers use ARTEX AI in automated attacks against 200 orgs (2 November 2026)
• Microsoft Security Blog: Threat actors use agentic AI tooling to find and abuse exposed secrets (5 November 2026)
• Cloud Security Alliance: CISO Daily Briefing (9 November 2026)