AI coding agents accelerate the rate of leaked credentials

AI-driven development is significantly accelerating the exposure of sensitive credentials, a phenomenon known as ‘secrets sprawl’. According to GitGuardian’s 2026 State of Secrets Sprawl Report, AI-assisted commits are leaking secrets at approximately twice the rate of human-written code. Last year, exposed credentials reached 1.27 million, marking an 81% increase.

AI coding agents expand the attack surface by hardcoding credentials into more files and spreading them across various systems, including Model Context Protocol (MCP) configuration files, AI tool caches, and terminal session logs. The speed at which these agents can modify files and interact with external services often outpaces the ability of security teams to detect and rotate keys.

A critical issue is the longevity of these leaks; 64% of secrets confirmed as valid in 2022 remained unrevoked as of January 2026. To combat this, GitGuardian has implemented Public Secrets Monitoring, utilizing AI agents to analyze incidents on GitHub and Docker Hub to provide risk scores and organizational verdicts, aiming to reduce the noise and improve response times for security teams.