The attacks in Microsoft’s November 6 report are embarrassingly ordinary. Exposed .git directories leaking credentials. Overprivileged service principals nobody has looked at since 2023. OAuth apps consenting to scopes they were never meant to hold. Conditional Access policies with a hole wide enough to drive a token through. If you’ve done an identity assessment in the last five years, you’ve written these findings up yourself.
What changed is who’s doing the looking. According to Microsoft Threat Intelligence, the actor it tracks as Storm-3358, a financially motivated group, began deploying an agentic AI offensive framework called ARTEX against financial-sector organizations in October 2026. ARTEX is built to run security testing and exploitation as an autonomous agent: it discovers misconfigurations, hunts exposed credentials, enumerates OAuth application permissions, and probes authentication weaknesses without a human operator steering every step.
That last clause is the whole story. Let me bring in the skeptic, because I’ve had this argument three times this week.
“This is just a scanner with a language model bolted on”
“Come on. We’ve had automated recon since Nessus. nmap doesn’t need a human either. You’re telling me ‘autonomous AI’ and I’m hearing ‘cron job with marketing.'”
Partly fair. The individual techniques here are old. OAuth consent abuse, service principal credential theft, MFA-gap reconnaissance, none of that is novel, and anyone selling ARTEX as a new class of attack is selling you something. A scanner finds the open door. It doesn’t decide which door is worth walking through, chain three findings into a path to a privileged app registration, then adjust when your Conditional Access blocks the first attempt.
That chaining and adaptation is the part that used to require a skilled operator, someone who understood that a leaked read-only token plus an over-permissioned Graph application plus a service principal with Application.ReadWrite.All equals a way to mint your own credentials. An agent that can reason across those findings, decide what to try next, and do it at three in the morning on a holiday weekend is not nmap. It’s the junior red-teamer you could never afford to staff around the clock, replicated across every target at once.
“Fine, but these agents still need human tasking, right? So it’s not actually autonomous.”
Correct, and I’d push back hard on anyone who oversells this. A human still sets the objective and almost certainly reviews what comes back before the big moves. The autonomy is in the middle, the enumeration, correlation, and opportunistic probing between “go” and “here’s what I found.” But that middle is exactly where defenders used to win. Attacks stalled because manual recon is tedious and operators get bored, distracted, or priced out of spending a week on one tenant. Remove the boredom and the cost, and marginal targets that were never worth a human’s time are suddenly worth a machine’s. The economics flipped, not the physics.
Where the robot goes first
Storm-3358’s shopping list, per the report, is the stuff you already know is weak and keep meaning to fix. Here’s the order I’d harden it in.
Kill exposed .git and config leaks. This remains the single dumbest, most common foothold, and an agent finds it in seconds. A public .git folder or a committed appsettings.json with a client secret is a credential handed over at the door. Check your external footprint and rotate anything that ever touched a repo:
Audit app registrations and service principals for standing privilege. Over-permissioned service principals are the prize, because a compromised app identity doesn’t trip MFA and often doesn’t trip anybody’s alerting either. Pull every app holding high-risk application permissions, Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All, RoleManagement.ReadWrite.Directory, Directory.ReadWrite.All, and justify each one or revoke it.
While you’re in there, find credentials that outlive the people who created them. Long-lived or expired-but-still-present secrets and certs on app registrations are exactly what automated harvesting looks for.
Close the Conditional Access gaps the agent is counting on. The classic holes: legacy authentication still permitted somewhere, a “report-only” policy everyone forgot to flip to enforce, excluded accounts that were meant to be temporary, and no coverage for service accounts. Block legacy auth outright, require phishing-resistant MFA for admin roles, and move toward token protection and sign-in risk policies. An agent probing for MFA gaps is probing for your exceptions, not the rule.
Stop issuing refresh tokens like they’re free. Overbroad OAuth consent and user-grantable permissions let an agent walk a low-value foothold into Graph access. Restrict user consent to verified publishers and low-risk scopes, and set up an admin consent workflow so humans see the requests.
What it looks like when it’s happening
Detection is where you have an edge, because an autonomous agent is fast and tireless in ways humans aren’t, and that’s a signature. Watch for abnormal Microsoft Graph API call volumes from a single app or principal, OAuth token requests at a cadence no human would produce, authentication attempts from geographies your users don’t live in, and spikes in failed sign-ins that read as enumeration rather than a few fat-fingered passwords.
The paradox cuts both ways. A machine that enumerates your tenant at machine speed is louder than the careful human operator it replaced. The patient attacker who throttled to stay under your thresholds is the hard one to catch. If Storm-3358’s agents are banging on Graph at volume, your sign-in logs and audit logs already have the evidence, the question is whether anyone’s alerting on the rate and not just the individual events.
None of this is a new defensive playbook, and that’s the uncomfortable part. We’ve been told to rotate credentials, prune app permissions, and close Conditional Access gaps for years, and most shops did it to about 70 percent and moved on. The 30 percent you deferred was fine when exploiting it cost an attacker a week of expensive human attention. It costs a machine a few cents now. The grace period you were running on was never a control. It was just the price of your adversary’s time, and that price just collapsed.