Five minutes. That's how long it took an AI agent to go from scanning public GitHub repos to pulling data out of an Azure Key Vault.
Microsoft Threat Intelligence published new research this week on ARTEX, an agentic AI offensive framework that attackers are using to hunt for exposed secrets: API keys, cloud credentials, and AI inference keys left in code. The agent doesn't just find the secret. It analyzes it, tests it, and runs the follow-on attack, with almost no hands-on-keyboard time from the operator. A day later Microsoft reported a Cambodia-based group, Storm-3358, using ARTEX against financial organizations to exploit file-upload and SSRF bugs and drop remote access trojans.
Why it matters
The old window between "a key got committed" and "someone used it" used to be hours or days. Now it's minutes, and it's automated. For small businesses and dev teams here on Vancouver Island, a few things are no longer optional:
- Turn on secret scanning and push protection for every repo, including private ones.
- Rotate any key that has ever touched a commit, even if you deleted it later.
- Use short-lived credentials and managed identities instead of long-lived keys.
- Lock down Key Vault and cloud storage with network rules and least-privilege access.
- Alert on unusual access, because attackers now move at machine speed.
AI agents are great for defenders too, but only if the basics are already in place.
Source: Microsoft Security Blog: Threat actors use agentic AI tooling to find and abuse exposed secrets
Originally posted on LinkedIn.
Top comments (0)