What Happened
Microsoft observed threat actors using the agentic AI framework ARTEX to find secrets in public GitHub repositories. In one case, an agent progressed from finding client secrets to exfiltrating Azure Key Vault data in five minutes. Stolen application credentials were also used to sign in as Microsoft Entra workload identities and search Microsoft 365 and Azure resources, read secrets, and invoke cloud services. Rapid retries and API-version changes made the activity adaptive as well as fast. [1]
This is part of a broader identity problem. Microsoft reported that credential theft accounted for roughly 94–96% of payload-based email attacks it detected in the third quarter of 2026. Its new AI security controls emphasize task-scoped agent permissions, risk-aware access, and containment for local agents. [3] [4]
Why It Matters to Businesses
An exposed credential can turn a repository mistake into access across Key Vault, documents, development systems, and cloud workloads. Removing the secret from GitHub does not revoke it. An AI agent with broad standing permissions can compound the same failure: a single compromised identity may reach more systems than its immediate task requires. [1] [3]
For leaders, the key question is not whether an agent is “secure” in isolation. It is what the agent can access, how long that access lasts, and whether security teams can reconstruct its actions across services.
Kimbodo Engineering Perspective
Identity and authorization are the primary control plane. Prompt defenses matter, but they cannot compensate for a leaked application credential or an agent granted unrestricted access to production data. We would separate human, application, and agent identities; give each workflow only the permissions it needs; and require explicit approval for high-impact actions.
Containment has a cost: narrower permissions and approval steps can slow workflows. That trade-off is preferable for secret reads, data exports, and infrastructure changes. Lower-risk read-only tasks can run with less friction, provided their access and outputs remain observable.
How We Would Implement It
- Inventory and ownership: Record agents, configured tools and MCP connections, service principals, repositories, data sources, and accountable owners. Use agent and MCP discovery where available. [3]
- Prevent credential exposure: Enable repository secret scanning and push protection; replace stored credentials with managed identities where feasible; restrict app registration and scope application permissions. [1]
- Constrain execution: Issue task-scoped access, isolate agent runtime environments, and gate secret access, outbound transfers, and cloud-changing tool calls. Evaluate dynamic permissions and execution containers against the organization’s platform requirements. [3]
- Detect cross-service movement: Correlate sign-in failures and successes with Key Vault reads, downloads, Azure DevOps activity, and Microsoft 365 access. Alert on machine-speed sequences rather than depending only on fixed IP addresses or user agents. [1]
- Rehearse response: Rotate exposed credentials, revoke sessions and other affected access, review reachable data, and disable compromised service principals when necessary. [1]
Risks, Costs and Security
Least privilege requires ongoing permission reviews, and cross-service detection requires usable logs, retention, and tuning to limit false positives. Runtime isolation adds operational complexity and does not replace cloud-side authorization. Incident response must account for downstream access: an exposed credential may already have been used to read secrets that themselves need rotation. [1]
Do not rely on one indicator of compromise as the boundary of an investigation. Microsoft identified IP addresses for hunting this activity but cautioned that one associated Tor exit node may include unrelated traffic; it recommended targeted blocking where applicable rather than blocking an entire ASN. [1]
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Security & Guardrails practice, or Request a Security Review.
