AI Coding Assistants Double Rate of Credential Leaks on GitHub
GitGuardian report finds AI-assisted commits leak secrets at 3.2%, far outpacing human baselines.
The rapid adoption of AI coding assistants is significantly accelerating the exposure of sensitive credentials on public repositories. According to GitGuardian's 'State of Secrets Sprawl 2026' report, the velocity of AI-driven development is outpacing security governance, creating a high-velocity attack surface for malicious actors.
In 2025 alone, approximately 29 million secrets were leaked on public GitHub. The data reveals a stark disparity in security outcomes based on the tools used: AI-assisted commits, specifically those involving Claude Code, show a secret leak rate of 3.2%. This is more than double the 1.5% baseline observed in non-AI commits. Beyond standard code commits, the report identifies a new trend of secrets being exposed through Model Context Protocol (MCP) configuration files.
The Velocity Gap
This surge in leaks coincides with the transition of AI tools—such as Cursor, Lovable, and Claude Code—from experimental utilities to default developer workflows. As these tools accelerate the speed of code production, developers are increasingly accepting AI-generated diffs without rigorous auditing. Because AI assistants often suggest code containing placeholders or actual credentials, API keys, database connection strings, and service tokens are frequently hardcoded into public commits.
Systemic Remediation Failure
While the rate of new leaks is climbing, the industry is failing to clean up existing vulnerabilities. GitGuardian found that 64% of secrets confirmed as valid in 2022 remained exploitable or valid in 2026. This persistence suggests a systemic failure in secret rotation and remediation processes, meaning that a leak from four years ago may still provide a gateway into a corporate network today.
As GitGuardian noted in the report, "The difference between success and failure isn't finding more secrets, it's knowing which ones to fix first."
The Path Forward
Industry observers are now watching whether security tooling can evolve to match the speed of AI generation. The primary challenge remains the human element: the tendency to trust AI-generated code implicitly. Until automated secret scanning is integrated directly into the AI suggestion loop—rather than just the commit stage—the risk of immediate compromise is expected to rise. Organizations must now prioritize the rotation of legacy secrets while implementing stricter guardrails for AI-authored code.