{"slug": "the-agents-have-now-found-your-secrets-on-github-artex-is-abusing-public-secrets", "title": "The Agents Have Now Found Your Secrets On GitHub: ARTEX Is Abusing Public Secrets Right Now", "summary": "Microsoft Threat Intelligence reported on November 5 that threat actors are using an agentic AI framework called ARTEX to scan public GitHub for exposed secrets and abuse them, with one case moving from a GitHub scan to exfiltrating data from Azure Key Vault in five minutes. Censys counted roughly 1,400 publicly exposed ARTEX instances across about 800 deployments as of November 4, while a Check Point report published November 5 counted more than 1,800 exposed instances; ARTEX was pulled from GitHub on October 8 after the first report of threat-actor use, but attacks continued. GitGuardian, which published the analysis, counted 28.65 million new hardcoded secrets in 2025 and said 64% of valid secrets from 2022 remain active, noting that deleting an exposed commit does not help because a credential stays usable until it is revoked or rotated.", "body_md": "## TL;DR\n\n- **Five minutes from GitHub to Azure Key Vault:** Microsoft Threat Intelligence saw an ARTEX agent find OAuth application secrets on public GitHub, sign in as a service principal, and exfiltrate Key Vault data in five minutes.\n- **64% of 2022’s valid secrets still active:** GitGuardian counted 28.65 million new hardcoded secrets in 2025, and leaked credentials stay usable for years, giving agentic attackers a deep pool to search.\n- **Deleting the commit fixes nothing:** an exposed credential stays usable until someone revokes or rotates it, so check validity, ownership, and access, then revoke without waiting for proof of abuse.\n\nOn November 5, Microsoft Threat Intelligence published research showing threat actors using an agentic AI framework called ARTEX to [__search public GitHub for exposed secrets and abuse them__](https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/?ref=blog.gitguardian.com). The agents found OAuth application secrets, signed in as service principals, and moved through Azure and Microsoft 365 tenants. In one case, an agent went from scanning GitHub to exfiltrating data from Azure Key Vault in five minutes. **Five. minutes.**\n\nAt GitGuardian, we have been warning everyone about this exact scenario for years. The only new part is that the attackers are no longer working at human speed. This is what an attack on the [__credential layer__](https://blog.gitguardian.com/credential-layer-security/) looks like. A secret exposed in public code gives an attacker access to a trusted identity, which they can then use to move through cloud infrastructure and reach sensitive data. \n\n## What is ARTEX, and how widely is it being used?\n\nARTEX is an agentic penetration testing framework built to run offensive tasks autonomously. It is deliberately generic: it ships with only a minimal set of tools and instructions, and few of them are offensive. Most of the decision-making is left to the agent. The operator provides a goal and can step in later to correct the agent when it drifts.\n\nThe tool was published on GitHub in late July and received updates after that, the last one on Oct. 3. It was pulled from GitHub on Oct. 8, right after the first report of use by threat actors.\n\nThe removal did not stop the attacks, as Microsoft noted in its latest report. [Censys data](https://censys.com/blog/artex-agentic-asbestos/?ref=blog.gitguardian.com) shows roughly 1,400 publicly exposed ARTEX instances across approximately 800 distinct-looking deployments as of Nov. 4. A [Check Point report](https://research.checkpoint.com/2026/hacking-on-autopilot-inside-artex-cybercrime-campaigns/?ref=blog.gitguardian.com) published Nov. 5 reports more than 1,800 publicly exposed instances. The figures use different measurement methods, so they don't necessarily represent an increase of 400 instances in a single day. Both are incomplete views of ARTEX deployment, since its management interface does not need to be publicly exposed.\n\nARTEX can be fingerprinted with two requests. `GET /api/health` returns a distinctive JSON response on standard builds, and `GET /api/auth/status` discloses whether the first-run administrator setup is complete:\n\n```\nGET /api/health\n{\"ok\":true,\"service\":\"artex\",\"version\":\"...\"}\n\nGET /api/auth/status\n{\"initialized\":true|false}\n```\n\nTogether, these endpoints identify the application and reveal whether the deployment is still in its initial setup state.\n\nThe campaigns analyzed by Check Point were mostly opportunistic attacks conducted with minimal human intervention. Their objectives included:\n\n- Draining cryptocurrency\n- Stealing gaming accounts\n- Stealing Apple code-signing certificates\n\nSince the tool was first published, researchers have also linked ARTEX to attacks involving South Korean financial institutions, ConnectWise customer environments, and WorkOS. Not every reported target experienced a confirmed compromise, but the range of activity shows how broadly the framework is being used.\n\n## Do this today\n\nMicrosoft has observed this activity in real attacks. Their official reports recommend acting on publicly exposed secrets as soon as possible. CERT IN, [__in a recent report__](https://www.cert-in.org.in/s2cMainServlet?VLCODE=CIAD-2026-0058&pageid=PUBVLNOTES02&ref=blog.gitguardian.com) on the ARTEX threat, provides similar guidance.\n\nIf your organization has credentials exposed on GitHub, you need to know which ones are still valid and what they can access.\n\n1. **Check your public exposure with the** [**__GitHub Security Audit__**](https://www.gitguardian.com/github-security-audit?ref=blog.gitguardian.com)**.** Enter your company domain to assess secrets associated with your developers' public GitHub activity, including repositories outside your organization.\n2. **Scan your internal repositories for hardcoded secrets.** Public GitHub is the immediate hunting ground described in Microsoft's research, but your own repositories may contain credentials that create additional exposure. [__Start scanning with GitGuardian__](https://www.gitguardian.com/monitor-internal-repositories-for-secrets?ref=blog.gitguardian.com) to find secrets in your private code and commit history. You can start for free or evaluate broader capabilities through a business trial.\n3. **Prioritize and revoke exposed credentials.** Start with valid, high-privilege credentials, especially OAuth application and service principal secrets that provide access to sensitive cloud resources, data, or other credentials. Revoke or rotate exposed keys immediately, then investigate whether they were used. If an application was compromised, check what else it could access.\n4. **Need help assessing exposure at scale?** [**__Talk to our team__**](https://www.gitguardian.com/book-a-demo?ref=blog.gitguardian.com)**.** We can help you identify exposed credentials, prioritize the risks, and coordinate remediation across your organization. You can also reach us at sales@gitguardian.com.\n\n## The recipe has been the same since 2017\n\nSearching public code for credentials is the oldest trick in the cloud attack playbook. GitGuardian has scanned every public GitHub commit since 2017. The [__State of Secrets Sprawl 2026__](https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026/) counted 28.65 million new hardcoded secrets in 2025. Four years later, 64% of the valid secrets from 2022 are still active.\n\nPut those numbers next to the Microsoft research, and the conclusion writes itself. Millions of valid credentials sit in public GitHub repositories, many still valid years after they leaked. And AI is adding to the problem: leaks of AI-service secrets grew 81% in 2025 alone. Attackers have been automating the search for exposed credentials for years. Now, with agentic AI, they can find exposed credentials, test their access, and move through compromised environments with minimal human intervention.\n\n## Attackers are moving at machine speed, targeting your weakest link\n\nMicrosoft describes agents sending large volumes of GitHub queries that combine a target company name, secret keywords, and cloud or AI service names. Once inside a tenant, the agent corrected its own failed cloud API calls and retried within a minute or so until it succeeded. Picture a pentester who never sleeps, never gets bored, and costs a few dollars of inference. All it needs is one valid credential to gain access.\n\nWe've seen how quickly attackers can collect and spread stolen credentials. For example, in August 2025, the [__Nx s1ngularity attack__](https://blog.gitguardian.com/the-nx-s1ngularity-attack-inside-the-credential-leak/) became the first known malware our researchers looked into that hijacked AI CLI tools on developer laptops to hunt for credentials. Weeks later, [__Shai-Hulud__](https://blog.gitguardian.com/shai-hulud-a-persistent-secret-leaking-campaign/) turned stolen npm tokens into a self-spreading credential stealer. [__Shai-Hulud 2.0__](https://blog.gitguardian.com/shai-hulud-2/) exposed more than 33,000 unique secrets. The [__Mini Shai-Hulud wave__](https://blog.gitguardian.com/a-mini-shai-hulud-targeting-the-sap-ecosystem/) showed the worm still adapting in 2026. These campaigns dumped stolen secrets onto public GitHub, the same hunting ground the ARTEX agents now search.\n\n**The reality is you need to assume breach right now**. Security teams should treat publicly exposed secrets as compromised and apply the same precaution to exposed credentials in internal repositories and systems. Identify which credentials are still valid, understand what they can access, and revoke or rotate them. Investigate whether they've already been used, but don't wait for confirmation of abuse before acting.\n\nRevoking credentials without knowing what it breaks also brings risks. This leads many teams to think the best move is to simply take those repos offline. That is not enough, though.\n\n## Deleting the commit fixes nothing\n\nMicrosoft says it plainly. A publicly exposed credential stays usable until someone revokes or rotates it. Deleting the file or rewriting Git history doesn't invalidate it. Finding an exposed secret is only the first step. You need to know whether it's still valid, who owns it, and what it can access before you can effectively remediate it.\n\n## Detect, remediate, and prevent\n\nAttackers are moving faster than ever, and security teams need to know which credentials are exposed, what they can access, and how to shut down that access before attackers can abuse it.\n\nGitGuardian helps organizations discover exposed credentials across public and private environments. Our free [__GitHub Security Audit__](https://www.gitguardian.com/github-security-audit?ref=blog.gitguardian.com) identifies public exposure associated with your developers, while [__Internal Secrets Monitoring__](https://www.gitguardian.com/monitor-internal-repositories-for-secrets?ref=blog.gitguardian.com) finds hardcoded secrets across private repositories and CI/CD pipelines. We also built [__HasMySecretLeaked__](https://blog.gitguardian.com/announcing-has-my-secret-leaked), a free way to check whether a credential has appeared on public GitHub without revealing the secret itself. Our [__public leak checks__](https://blog.gitguardian.com/unveiling-public-leak-checks-for-hardcoded-secrets-in-the-gitguardian-platform) extend that visibility to credentials stored in vaults and pipelines.\n\nFinding exposed credentials is the beginning. GitGuardian helps teams prioritize remediation by validating which credentials are still active and providing context about their owners, identities, permissions, and potential impact. Incident grouping, automated routing, and custom playbooks help teams coordinate remediation at scale. For supported providers, GitGuardian can even revoke compromised credentials directly, cutting off attackers' access.\n\nWe also need to prevent the next leak. GitGuardian's [__ggshield__](https://docs.gitguardian.com/ggshield-docs/integrations/overview?ref=blog.gitguardian.com) catches secrets before they reach repositories through pre-commit and pre-push scanning. [__Developer Endpoint Protection__](https://www.gitguardian.com/developer-endpoint-protection?ref=blog.gitguardian.com) helps find credentials stored on developer machines, while [AI Hooks](https://docs.gitguardian.com/endpoint-protection/ai-hooks?ref=blog.gitguardian.com) add preventative controls to AI coding workflows, stopping secrets from being exposed through agent actions.\n\nThe robots have arrived, and they read GitHub faster than any of us. Let's make sure they don’t find secrets.\n\n## FAQ\n\n## What is ARTEX?\n\n      ARTEX is an agentic penetration testing framework built to run offensive tasks autonomously. It ships with only a minimal set of tools and instructions and leaves most decisions to the agent: the operator sets a goal and can step in to correct the agent when it drifts.\n\n      The tool was published on GitHub in late July 2026 and pulled on Oct. 8, right after the first report of its use by threat actors.\n    \n\n## How are attackers using ARTEX to abuse exposed GitHub secrets?\n\n      According to Microsoft Threat Intelligence, ARTEX agents send large volumes of GitHub queries that combine a target company name, secret keywords, and cloud or AI service names. When they find OAuth application secrets, they sign in as service principals and move through Azure and Microsoft 365 tenants.\n\n      In one case Microsoft observed, an agent went from scanning GitHub to exfiltrating data from Azure Key Vault in five minutes.\n    \n\n## Did removing ARTEX from GitHub stop the attacks?\n\nNo. The removal did not stop the attacks, as Microsoft noted in its latest report. Censys data shows roughly 1,400 publicly exposed ARTEX instances across approximately 800 distinct-looking deployments as of Nov. 4. A Check Point report published Nov. 5 reports more than 1,800 publicly exposed instances. The figures use different measurement methods, so they don't necessarily represent an increase of 400 instances in a single day. Both are incomplete views of ARTEX deployment, since its management interface does not need to be publicly exposed.\n\n## Does deleting a leaked secret from GitHub make it safe?\n\n      No. A publicly exposed credential stays usable until someone revokes or rotates it. Deleting the file or rewriting Git history does not invalidate it.\n\n      Treat any secret exposed in public code as compromised, then check whether it is still valid, who owns it, and what it can access.\n    \n\n## What should I do if my credentials are exposed on GitHub?\n\n      Assume breach. Identify which exposed credentials are still valid, understand what they can access, and revoke or rotate them, starting with high-privilege OAuth application and service principal secrets. Investigate whether they were used, but don't wait for confirmation of abuse before acting.\n\n      GitGuardian's free GitHub Security Audit shows public exposure tied to your developers, and HasMySecretLeaked checks whether a specific credential has appeared on public GitHub without revealing it.\n    \n\n## Why does agentic AI make leaked secrets more dangerous?\n\n      Attackers have automated the search for exposed credentials for years. Agentic AI also lets them test access and move through compromised environments with minimal human intervention, at machine speed.\n\n      The pool of targets is large: the State of Secrets Sprawl 2026 counted 28.65 million new hardcoded secrets on public GitHub in 2025, and leaks of AI-service secrets grew 81% that year.", "url": "https://wpnews.pro/news/the-agents-have-now-found-your-secrets-on-github-artex-is-abusing-public-secrets", "canonical_source": "https://blog.gitguardian.com/the-agents-have-now-found-your-secrets-on-github-artex-is-abusing-public-secrets-right-now/", "published_at": "2026-11-06 21:09:00+00:00", "updated_at": "2026-11-09 17:52:05.285939+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "artificial-intelligence"], "entities": ["Microsoft Threat Intelligence", "ARTEX", "GitGuardian", "Censys", "Check Point", "GitHub", "Azure Key Vault", "Microsoft 365"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/the-agents-have-now-found-your-secrets-on-github-artex-is-abusing-public-secrets", "markdown": "https://wpnews.pro/news/the-agents-have-now-found-your-secrets-on-github-artex-is-abusing-public-secrets.md", "text": "https://wpnews.pro/news/the-agents-have-now-found-your-secrets-on-github-artex-is-abusing-public-secrets.txt", "jsonld": "https://wpnews.pro/news/the-agents-have-now-found-your-secrets-on-github-artex-is-abusing-public-secrets.jsonld"}}