{"data":{"id":"c700e27c-6e2e-4646-985f-b389261e9e9f","title":"Threat actors use agentic AI tooling to find and abuse exposed secrets","summary":"Microsoft Threat Intelligence observed threat actors using the agentic offensive security framework ARTEX to search GitHub for OAuth application secrets. Compromised secrets let attackers act as the associated OAuth application and perform authenticated actions in the application's tenant. Agents acting for the threat actors then used these compromised OAuth applications to carry out further actions within the affected organizations.","solution":"N/A -- no mitigation discussed in source.","labels":["security","industry"],"sourceUrl":"https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/","publishedAt":"2026-11-05T23:46:50.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["other"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Microsoft"],"affectedVendorsRaw":["ARTEX","GitHub","OAuth applications"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-11-05T23:46:50.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null}}