Security1 publisher2 min readPublished
AI-assisted commits leak secrets at roughly double the human rate in GitGuardian's 2026 data
GitGuardian's 2026 State of Secrets Sprawl Report says commits identified as AI-assisted leak secrets at about twice the rate of human-written ones. Agent and MCP config files also keep plaintext keys on developer machines where commit scanning and code review never look.
The Watch · Security desk
What happened
- GitGuardian's 2026 report finds that most of the fastest-growing categories of leaked credentials are now tied to AI services.
- Coding agents hardcode credentials into more files and copy existing ones into more systems than security teams can track and rotate, the article says.
- Agent and MCP server setup often has developers paste a credential into a local config file that stays out of version control but is readable by the agent.
- The article argues that sprawl is a non-human identity problem, to be handled by limiting what each agent's identity is allowed to access.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint Pre-merge review by a developer cannot be the main secrets control when an agent reads, edits and calls outside services in the time one pull request takes to review.
- exposure Plaintext keys on a developer workstation are now reachable by any agent with project access, on top of the developer and the apps that reference them.
- decision Teams have to decide what each agent identity can reach before it runs, because retroactive detection triggers rotation only after a key is already out.
This kind of bug is old. The article says hardcoded and copied credentials are not a new vulnerability, and that AI changes the scale and pace of the mistakes [10]. The doubled rate comes from GitGuardian and reached readers through The Hacker News [1]. The article does not include the underlying leak rates, the sample size, how GitGuardian labeled a commit as AI-assisted, any case of an attacker using one of the leaked keys, or any discussion of credential expiry.
Developer review cannot absorb that pace. By the article's account, a coding agent can read a whole project, modify files, generate configurations and call external services in the time a developer might take to review one pull request [3]. The standard controls work after the fact: scanners watch repositories, pre-commit hooks catch what they can, and teams rotate credentials once an exposure is found [4]. The article says those controls still matter, and that agents show the limits of relying on detection alone [4].
Scanning agent output covers commits. Commits are also what the doubled rate counts [1]. Keys that stay on the developer's disk are outside both. Credentials pasted into agent and MCP config files sit there in plaintext, often where the agent has permission to read [7]. Leftover .env files work the same way. Unless access is explicitly limited, an agent with broad project access can read a production API key unrelated to its task [6].
GitGuardian's argument, as published, is about identity. Every capability an agent is given adds another place a credential is needed and another path for it to spread [8]. That list covers reading local files, running commands, calling APIs and MCP servers, and editing configuration [8]. Because no one can predict every action an autonomous system takes, the article puts the control on what the identity behind the agent may access [5]. Short-lived credentials apply the same limit to time. A key scoped to one task and expiring soon after is worth less to whoever copies it off a laptop or out of a commit.
What to watch
- Publication of GitGuardian's method: how commits were labeled AI-assisted and the base leak rates behind the twice-the-rate figure.
- Whether agent and MCP server setup guides stop telling developers to paste credentials into plaintext local config files.
- Any reported case of attackers harvesting keys from agent or MCP config files on developer machines.