Microsoft reports AI agents using exposed GitHub secrets to access cloud resources
Microsoft says exposed credentials remain usable until revoked or rotated, allowing attackers who find them to access authorized cloud resources.
• Microsoft says threat actors are using AI agents to find exposed secrets in public GitHub repositories.
• In one observed case, an agent reached Azure Key Vault data within five minutes of searching GitHub for client secrets.
• Microsoft advises affected organizations to remove exposed secrets and immediately rotate the credentials.
Read more
November 6, 2026 23
