DooDooLamb News
Threat actors use agentic AI tooling to find and abuse exposed secrets | Microsoft Security Blog
Brief published November 7, 2026 ยท Original source published November 5, 2026
Original reporting by Microsoft Threat Intelligence at microsoft.com.
Automated brief. Verify important details at the original source.
What happened
Microsoft Threat Intelligence reports observing threat actors using an agentic AI offensive security framework called ARTEX to scan public GitHub repositories for exposed secrets, including OAuth application credentials. According to the report, these exposed secrets can be used to compromise associated OAuth applications and perform authenticated actions on behalf of those applications. The framework is described as agentic, meaning it can autonomously chain steps to locate and potentially abuse discovered credentials without continuous human direction.
Why it matters
Agentic tooling lowers the skill floor for credential harvesting at scale. Attackers using autonomous frameworks can sweep public repositories faster and more systematically than manual methods, expanding the attack surface for any team that inadvertently commits secrets to public repos. OAuth credential abuse in particular can grant broad, authenticated access to downstream services.
What to watch
Whether ARTEX or similar agentic offensive frameworks become more widely available, and how repository hosting platforms and secret-scanning tools respond with countermeasures or policy changes targeting autonomous credential harvesting.