Data breach
Threat actors use agentic AI tooling to find and abuse exposed secrets
At a glance
Low rather than Medium: UK relevance is 40 of 100, little UK-specific signal so far.
Briefing
There is no written leader briefing for this story yet. The summary below says what is known so far.
Next steps
Monitor- For awareness — no fixed action deadline for this reporting
No technical write-up beyond the summary below yet.
Next steps
Monitor- No immediate technical action — track if your estate depends on the products or vendors discussed
Summary
- Microsoft Threat Intelligence has observed threat actors using the agentic offensive security framework ARTEX to search GitHub for OAuth application secrets, which can be used to compromise the associated OAuth application and perform authenticated actions in the application’s tenant. Agents operating on behalf of threat actors then used the compromised OAuth applications to perform a variety of subsequent actions within compromised organisations.
Read the original reportMicrosoft Security Blog(opens in a new tab)
Part of Harvard and Chainalysis data breaches
Pulse
Last change 3d ago · Recheck overdue since 7 Nov 2026, 02:02 UK time
- Story6 Nov 2026, 02:02 UK time · 3d ago
Linked reporting from Microsoft Security Blog (research).
Read source (Microsoft Security Blog)
1 entry so far. The timeline chart appears once this story has more history.
Sources
- Microsoft Security BlogResearcher
Threat actors use agentic AI tooling to find and abuse exposed secrets
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
Threat actors use agentic AI tooling to find and abuse exposed secrets
- ProbableSummary fact75% confidence
Microsoft Threat Intelligence has observed threat actors using the agentic offensive security framework ARTEX to search GitHub for OAuth application secrets, which can be used to compromise the associated OAuth application and perform authenticated actions in the application’s tenant. Agents operating on behalf of threat actors then used the compromised OAuth applications to perform a variety of subsequent actions within compromised organisations.