Threat actors use agentic AI tooling to find and abuse exposed secrets

Summary

Microsoft Threat Intelligence observed threat actors using the agentic offensive security framework ARTEX to search GitHub for OAuth application secrets. Compromised secrets let attackers act as the associated OAuth application and perform authenticated actions in the application's tenant. Agents acting for the threat actors then used these compromised OAuth applications to carry out further actions within the affected organizations.

Topics

• AI agents

Related items

• MediumFake OpenAI, SpaceX events used to steal Microsoft, Google accountsSame vendor · BleepingComputer
• Info​​​​What’s new in Microsoft Security: November 2026Same vendor · Microsoft Security Blog
• MediumTop AI agent security resources — November 2026Same vendor · Adversa AI Blog
• InfoRadio With No Radar: Why Agent Runtime Security Fails Without the Layers Beneath ItSame vendor · The Hacker News
• InfoWhen File Ingestion Misleads Language Models: Measuring and Mitigating Divergences in Office DocumentsSame vendor · Arxiv (cs.CR + cs.CL + cs.LG)