Microsoft has warned that attackers are using AI agent tools to scan public GitHub repositories for exposed secrets, including company names, cloud keys, and AI service keys, and that the activity has been running since August.
Microsoft warning · AI agent secret scanning
AI agents are hunting for exposed keys in public GitHub repositories
Microsoft says attackers have been using AI agent tools since August to scan public code repositories for leaked company names, cloud keys, and AI service keys. The agents run continuously, and a single working key can be enough to gain a foothold.
Since August
Duration of the reported activity, described as ongoing rather than a one-off incident.
1 key
A single working secret can give an attacker a foothold in an organization's systems.
Continuous
Agents keep searching without a human operator monitoring them around the clock.
How an exposed key becomes a foothold
Loop as described in the warning
STEP 1
Secret committed to code or config
→
STEP 2
Visible in a public repository
→
STEP 3
AI agent scans and interprets results
→
STEP 4
Agent decides next check and tries the key
→
STEP 5
Foothold in cloud or AI services
Reinforced guidance
Avoid committing secrets to code.
Rotate keys that may have been exposed.
Use secret management and scanning before code is pushed.
Review repository history for leaked credentials as a first step.
Not detailed in the warning
Number of affected organizations.
Exact tools involved.
Full sequence of actions after a key is found.
Key question
Can defenders detect agent-driven scanning as quickly as attackers can automate it?
Lower cost
Agents need less manual effort than traditional scanning.
Adaptive
They interpret results and decide what to check next.
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article...