An exposed secret, a trusted connection with too much access, or an overlooked security setting can give an attacker a way in. An AI service key can also leave its owner paying for the computing used in the search.
The short version: Amazon says it observed records of an AI-assisted campaign that used stolen AI service credentials to fund further credential hunting. The FBI separately warned that criminals are using an AI-enabled tool called ARTEX in real intrusions. The reports do not establish that AI independently chose its targets or that every reported attack was successful.
Why it matters: A stolen application key can provide access even after a person changes their password. If a business suspects exposure, its security team needs to identify and revoke the affected keys and connected-app access, then investigate what those credentials could reach.
Amazon published its findings on November 13, the same day the FBI issued its warning. The incidents and research behind them span earlier months; the evidence does not point to one single attack. We reviewed the sources on November 15.
What Amazon's decoys revealed
Amazon's security researchers operate a network of decoy systems called MadPot. Think of a decoy as a monitored front door that looks like a real service. When an attacker interacts with it, researchers can examine what was sent without placing a real customer system in front of them.
From October 3 to November 5, Amazon says, its sensors received requests from AI agents carrying records of their previous work. The sensors looked like interfaces used to access AI models. The requests contained the agents' instructions, tool histories and reported findings, giving researchers a window into campaigns that the agents described as they worked.
According to Amazon's November 13 report, the largest campaign in those records involved searching for AI access credentials. Stolen keys were used to pay for the AI processing needed to continue the hunt. Amazon assessed with moderate confidence that the campaigns used ARTEX, based on references and other technical clues.
There is a crucial limit. Amazon could observe requests to its own decoys and assess activity referencing potentially affected AWS customers, whom it says it notified as appropriate. It could not independently confirm everything the agents' records claimed had happened at other organizations. An attacker's report of success is a lead, not automatically proof of a completed breach.
Why a key can be worth more than a password
An application programming interface key, usually called an API key, is a secret that lets software identify itself to another service. A developer might use one to connect a website to an AI provider. Other credentials let an application access a cloud account, a database or a business's documents.
Unlike a password typed by a person, a key may be saved inside an application, a cloud setting or a development environment. Depending on its permissions, possession of that key can let software make requests, use paid services or retrieve information without a person signing in each time.
That makes the distinction between types of access essential. An AI service key does not automatically open an email inbox. A connected application credential with permission to read a mailbox or cloud files can create a different and potentially more serious problem. The risk depends on what the credential actually permits, where it was used and whether it is still valid.
Key idea: Removing an exposed key from a file is not the same as revoking it. Until the provider invalidates it, a copied key may still work.
Microsoft makes that distinction in its research on exposed credentials: organizations should rotate exposed secrets, not merely delete them from public code. A replacement also has to be installed in the services that legitimately depend on it, so containment and restoration need to be coordinated.
Five minutes from discovery to data theft
Microsoft reported that attackers were using agentic AI tools to search public GitHub repositories for exposed secrets and pursue opportunities that those secrets created. In one observed case, it said an agent went from searching GitHub for application secrets to taking data from an Azure Key Vault in five minutes.
Azure Key Vault is a service organizations can use to store secrets and other sensitive material. The five-minute figure describes one case observed by Microsoft, not the average time for an AI attack or a deadline by which every organization will be breached.
In related activity, Microsoft said stolen application credentials were used against some organizations' Microsoft Entra identities and connected cloud services. It observed access to SharePoint and OneDrive in some tenants, including file downloads and mailbox-item access. The company also described attempts to find additional credentials and create persistence, meaning an access path that can remain after the original entry point is closed.
For someone dealing with an account compromise, this changes the recovery question. A clean password is necessary when a password is exposed, but it is not proof that every connected application, token, administrator account or forwarding rule is safe. Our Microsoft account recovery steps address personal-account access; a workplace administrator must also investigate the organization's applications and cloud identities.
One trusted provider, many doors
The danger of connected access became visible in a separate incident involving ConnectWise Cloud Backup, formerly SkyKick. Businesses and their IT providers use services like this to connect with customer environments. That connection can be useful precisely because it has permission to do work across those environments.
ConnectWise reported unauthorized access to application credentials and took affected connections offline while it investigated and restored services. The company said individual Microsoft 365 environments needed review for unauthorized changes or persistent access.
In its own analysis of a related campaign, Microsoft attributed activity to a China-aligned group it tracks as Storm-0940 and said the actor used ARTEX to attempt sign-ins to more than 2,250 customer environments, also called tenants. Microsoft identified follow-on activity in multiple environments, including changes involving identities and privileges.
Those figures need care. An attempted sign-in is not proof that data was stolen from every tenant. Microsoft says even successful authentication does not, by itself, establish unauthorized data access or exfiltration. The vendor relationship and the AI activity matter because they can widen and accelerate the investigation, not because every connected customer necessarily suffered the same harm.
The real-world cost is more than the AI bill
An unexpected AI or cloud bill may be the first visible sign that a key is being abused. But the invoice is only one possible consequence. A compromised credential may also expose information, allow changes to an application, interrupt a service during containment or force an organization to replace connections across many systems.
Those costs are not interchangeable. An attempted sign-in, a successful login, a downloaded file and a confirmed financial loss are different findings. Investigators need to know which occurred before estimating the damage. Neither Amazon's decoy research nor the FBI alert establishes a reliable global price tag for these campaigns.
That distinction matters to individuals too. If a provider tells you that an incident may affect your account, check the notice through the provider's official website or app. Follow its specific instructions, use a unique password if a reset is advised, and be alert for impersonators who use breach news to demand passwords or verification codes.
What the FBI is warning about
In its November 13 alert, the FBI said malicious actors had used ARTEX since at least August in campaigns targeting sectors including finance, healthcare, government and technology. It described the tool as a way to automate multiple stages of an intrusion, from finding exposed systems to taking data.
ARTEX is a framework that can connect to external AI models. It is not a single AI model, and the presence of the tool does not identify one attacker or prove that every system it encounters has been compromised. Security tools can be used with permission for testing and misused by criminals.
The FBI also described a separate campaign against South Korean financial institutions in which it said personal information belonging to approximately 67,000 people was taken. That is the bureau's figure for that campaign, not a count of all ARTEX victims worldwide.
Where the human operator still fits
The most dramatic version of this story would claim that AI decided to fund and run a global crime operation by itself. Amazon's evidence supports a narrower and more useful account. It says people gave the agents standing instructions, including objectives and targeting rules; the agents then performed work within those instructions.
A human-directed operation can still be dangerous when software performs many steps quickly. But it is different from a self-replicating worm, a model with independent criminal intent, or proof that an AI system caused an unrelated service outage. Our earlier analysis of AI traffic, trust and the fragility of online services separates those questions for the same reason: connecting events is useful only when the evidence supports the connection.
If your organization suspects a stolen key
Move quickly, but do not make a key disappear before the people responsible for the service can preserve the information needed to investigate. If a credential may still be active, the priority is to restrict or revoke it through the relevant provider while coordinating with your security team. Keep private keys and tokens out of tickets, email and chat messages.
- Identify the affected access. Work out which provider issued the credential, what it can reach, who owns the service and whether it is used anywhere else. If the exposure involves a vendor, contact that vendor through a verified channel.
- Revoke or rotate the secret. Disable the compromised key or credential through its provider and replace it where legitimate services need access. Deleting a leaked file alone does not cancel a copied secret.
- Review activity and changes. Preserve relevant sign-in, application and cloud logs. Check for unfamiliar applications, new credentials, privileged accounts and other changes that could preserve access. Determine whether files were actually accessed or copied.
- Check costs and recovery. Review usage and billing for unexpected activity, document the time and scope, and ask the provider about its incident and billing process. Test that replacement credentials and restored services work safely.
- Reduce future exposure. Remove unnecessary permissions, use short-lived credentials or managed identities where supported, scan for exposed secrets and make sure someone owns each connected application.
For a personal account, begin by protecting the email address and recovery methods that control your other sign-ins. Our guide to recovering a hacked account when you cannot sign in explains how to identify what access you still control. Business administrators should also review the provider's incident guidance and seek qualified help if the scope is unclear.
The uncomfortable lesson
AI has not made old security failures obsolete. It has made the time between an exposed credential and its misuse harder to predict. A key left in an old project can have consequences far beyond the person who created it.
The deeper issue is invisible trust. Organizations know the people who sign in, but may have a less complete picture of the software identities acting on their behalf. When an attacker obtains one of those identities, changing a person's password may leave the most useful door open.
The same technology that makes software more capable is making its permissions more consequential. The question is no longer only who has access. It is which systems can act, what they can reach, and how quickly that access can be stopped.