Microsoft said on Thursday, Nov. 5, that attackers are using AI agents, AI that can carry out tasks on its own instead of only answering questions. Microsoft says the agents comb public code on GitHub, a site where programmers share code, for secrets that developers left in it. Those secrets include passwords, the login details apps use, and keys that unlock AI services. The attackers can then use what they find to get into the cloud systems of the organizations whose secrets leaked.
Hunting for leaked keys in public code is a well-known trick, Microsoft says, but it used to be slowed by how long people took to find the code, read it and try what they found. Microsoft says AI agents can do all of that quickly, with less need for a person at the keyboard. It says it has seen the searches since August, made with AI tools built for testing a network's defenses, such as one called ARTEX. Microsoft says this is part of an ongoing trend of attackers using such AI tools to speed up every step of an attack. In one case, an agent went from searching GitHub to taking data from a company's store of secrets on Microsoft's cloud in five minutes.
From as early as Oct. 28, Microsoft says, an AI agent tool used leaked or stolen app logins to get into some organizations' Microsoft cloud systems. It then downloaded files from SharePoint and OneDrive, Microsoft's file-sharing services, and opened items in mailboxes. Microsoft says the agents went after keys for AI services in particular, and that the attackers may have tried to use the stolen AI services to help run the attack itself. When a request failed, the software changed one setting and tried again, in one case about 28 seconds later, and the retry worked. Microsoft says this looks like a tool fixing its own mistakes as it goes.
Todyl, a separate security company, has tracked attacks since Nov. 1 from the same internet address that Microsoft names. It says one operator has been signing in as companies' own software, using stolen logins that still work, and through IT firms that manage other organizations has reached 27 organizations so far, including some in government, energy, law and education. In an update on Nov. 6, after Microsoft's report, Todyl said Microsoft's findings match its own: the attacks come from an automated AI tool that finds leaked keys, signs in with them and acts on what it collects with little human direction. Todyl had earlier pointed to long pauses, and a switch in how the software identified itself once it was detected, as signs of a person steering it.
Microsoft says deleting a leaked key from the code does not make it safe, since the key keeps working until it is canceled or replaced, so any key that was ever public should be replaced. It also suggests decoys: fake targets, and fake signs of success that can make an attacking agent think its job is done and stop. Microsoft says that in its own testing, these helped reduce the attack traffic that reached real systems.
Microsoft has not said how many of its customers were hit, though it says the attackers signed in to dozens of apps across several organizations, and neither company has named who is behind the attacks. Todyl's count covers only organizations that send it their logs, so it says the real number is likely higher. In its update, Todyl says stolen logins gathered from public places are the most likely way in, since it found no sign that the organizations' systems had been broken into first. Many of the apps hit were built by the organizations themselves, it says, which makes logins left in public code or on websites the likely source.
Update (Nov. 7): an earlier version of this story said Todyl's records did not show an AI directing the attacks. In a Nov. 6 update, Todyl said Microsoft's findings match its own assessment that an automated AI tool is behind them.