Threat Intelligence

AI Coding Assistants Are Doubling the Rate of Leaked Secrets, Report Warns

The Hacker News · 24 Sept 2026

Key Takeaway Small businesses using AI coding tools should review how credentials are stored and shared in their development process, and prioritise proactive secret rotation rather than relying solely on after-the-fact detection.

AI coding agents are speeding up software development, but they are also speeding up the exposure of sensitive credentials. According to GitGuardian's 2026 State of Secrets Sprawl Report, commits identified as AI-assisted leak secrets at approximately twice the rate of those written by humans, with many of the fastest-growing leak categories tied to AI services themselves.

The underlying problem, known as secrets sprawl, isn't new. It happens when credentials such as API keys, tokens and service account details spread across more systems than a business can properly track and rotate, often hardcoded into files, pasted into configurations or left in tickets. What has changed is the scale and speed at which this happens. AI coding agents can read entire projects, modify files, generate configurations and interact with external services far faster than a human reviewing a single change, creating more opportunities for credentials to be exposed or duplicated.

Traditional defences like repository scanners and pre-commit hooks still play a role, but the report suggests they aren't enough on their own. Because AI agents can execute commands, call APIs and interact with additional systems such as MCP servers, each new capability creates another potential path for a credential to leak or spread.

AI security secrets management software development data exposure

Summarised by CISO AI from The Hacker News. We link back to every original so you can read it yourself.