Executive Summary
Microsoft and VulnCheck have identified a sophisticated campaign dubbed 'Agentic AI Secret Hunter' that utilizes agentic AI frameworks to automate the discovery and exploitation of exposed secrets. The actor uses automated tooling to search GitHub for leaked credentials and exploits vulnerabilities in AI platforms like Langflow (CVE-2025-3248) to gain initial access. Once inside, the agent performs rapid environment reconnaissance and credential decryption, transitioning from initial probe to full data exfiltration in minutes.
The attack chain involves highly adaptive, machine-speed retries where the agent modifies its own payloads based on previous failures, particularly when attempting to decrypt Langflow variables or bypass API versioning in Azure Resource Manager (ARM). The primary infrastructure linked to this activity includes IP address 199.19.77[.]84, which has been observed signing into Entra ID tenants and Azure Key Vaults using stolen application secrets.
This campaign highlights the increasing speed of modern exploitation; attackers are now using AI agents to target the very AI tools organizations are deploying. The impact is significant, as it leads to the compromise of multitenant vendor applications, exposure of sensitive cloud metadata, and unauthorized access to high-value Azure AI services and storage.