Microsoft says that, in at least one observed case, an AI agent went from scanning public GitHub repositories for exposed secrets to exfiltrating data from Azure Key Vault in five minutes. The company’s November 5 report describes a credential-abuse route to cloud resources. It does not identify the data taken in that case or detail every step along the way.

What the five-minute account describes

Microsoft said it had observed high-volume searches for exposed secrets on GitHub beginning in August 2026. The searches could combine organization names with secret-related terms and cloud or AI service keywords. The five-minute interval refers to one reported progression from searching GitHub to exfiltrating Azure Key Vault data, not a general measure of how long such activity takes.

Microsoft describes exposed or stolen application credentials being used to access cloud resources within the permissions those credentials allowed. Azure Key Vault manages secrets, keys and certificates, and access requires authentication and authorization, according to Microsoft’s Key Vault documentation.

The company also reported separate service-principal sign-ins from 199.19.77[.]84 as early as October 28, 2026, involving multiple application IDs at some affected customers. A service principal is an application identity used to access services. In some cases, Microsoft said, a credential for a multitenant vendor application was compromised at its source and then used in downstream tenants.

Other infrastructure observations have distinct scope. Microsoft said it saw sign-ins from 199.19.77[.]18, a Tor exit node that might be associated with unrelated malicious activity. It also reported malicious operations from 65.87.223[.]26 and reconnaissance targeting AI workloads from 157.22.126[.]128, without tying every observation to one actor.

Microsoft’s IP-blocking guidance has specific limits

For the sign-ins associated with 199.19.77[.]84, Microsoft recommends blocking that exact address, 199.19.77[.]84/32, in a Conditional Access policy for workload identities rather than blocking the entire autonomous system number (ASN). The policy requires Workload ID Premium and applies only to single-tenant apps registered in the customer’s tenant.

Those conditions matter when choosing a response: the policy does not apply to every application or tenant configuration. Microsoft’s report also lists credential and session steps for organizations investigating suspected exposure:

  • Remove affected application secrets, certificates and federated credentials.
  • Rotate exposed credentials, including credentials the affected application could access in vaults or documents.
  • Revoke affected Microsoft Entra sessions, Azure DevOps personal access tokens (PATs) and SSH keys.
  • Review relevant identity, Azure, Key Vault, Storage, Azure DevOps and Microsoft 365 audit activity.
Practical point: Removing a compromised credential does not immediately expire tokens already issued to the application; Microsoft says those tokens remain valid until they expire.

Microsoft also recommends using managed identities where supported and limiting permissions for workload identities.