Secrets Sprawl Is an Identity Problem That AI Just Made Impossible to Ignore
GitGuardian finds AI-assisted commits leak secrets about twice as often as human-written code.
GitGuardian’s 2026 State of Secrets Sprawl Report finds commits identified as AI-assisted leak secrets at about twice the rate of human-written commits, with the fastest-growing leaked credential categories tied to AI services. The article says coding agents can read .env files, execute commands, call APIs, and use Model Context Protocol servers, spreading hardcoded API keys, tokens, and service-account credentials into configs, CI/CD variables, and tickets. It argues detection alone fails and that organizations should govern these non-human identities, because over-permissioned agent and orchestrator credentials can cascade access. A Keeper Security RSAC 2026 survey is cited, but its specific finding is truncated in the source.
- AI-assisted commits leak secrets at about twice the human rate.
- Fastest-growing leaked credential categories are tied to AI services.
- Coding agents can read .env files and hardcoded MCP credentials.
- Duplicate secrets in tickets and CI remain valid after repo rotation.
- Over-permissioned agent orchestrators can cascade identity access.
- Products
- Model Context Protocol
- Organizations
- GitGuardianKeeper Security
From the original article
7 min read at thehackernews.com
AI coding agents are changing how quickly developers can build and ship software as well as how quickly credentials can become exposed. According to GitGuardian’s 2026 State of Secrets Sprawl Report, commits identified as AI-assisted are leaking secrets at approximately twice the rate of human-written ones. Most of the fastest-growing categories of leaked credentials are now connected to AI
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.