November 2026 retrospective · Added November 13, 2026.
On November 5, 2026, Microsoft reported observing threat actors use agentic AI tooling to search public code repositories for exposed credentials and carry out follow-on activity. In one observed case, an agent progressed from finding secrets to exfiltrating data from Azure Key Vault in five minutes.
Automation compresses the response window
The underlying problem—credentials exposed where they do not belong—is familiar. The development is the ability to automate more of the work between discovery and abuse. The five-minute example is a reported case, not a universal speed or a prediction for every attack.
For a business, the lesson is practical: a leaked application credential can provide access without an attacker first compromising an employee’s laptop. Software integrations and service accounts deserve attention alongside human accounts.
Questions worth asking now
Do we know which applications and integrations hold access to business systems?
Are credentials stored in approved systems rather than code, documents, or chat?
Can we identify and revoke an exposed credential quickly?
Are application permissions limited to what the integration actually needs?
Who reviews unusual application sign-ins and access patterns?
Our business takeaway
AI does not make basic security work obsolete. It increases the value of doing that work consistently and responding quickly. Inventory integrations, assign owners, review permissions, and test the process for withdrawing access.
Removing an exposed secret from a visible file is not enough if copies or history remain. Treat suspected exposure as an incident requiring investigation and credential replacement through an approved process. Preserve evidence and coordinate changes so critical integrations can be restored safely.
Explore Proper Access Cybersecurity and AI Solutions.
Source: Microsoft Threat Intelligence and Security Research, November 5, 2026.
