AI-written code leaks secrets at twice the human rate

Commits produced with the help of AI coding agents are leaking credentials at about twice the rate of human-written code, according to GitGuardian's 2026 State of Secrets Sprawl Report, summarised by The Hacker News on 24 September 2026.

Secrets sprawl is the industry term for credentials \u2014 API keys, tokens, passwords and certificates \u2014 ending up somewhere they should not be, such as a source code repository. GitGuardian, which sells secrets detection tooling, scans public and private code for these exposed values and publishes an annual count.

The headline finding is a ratio rather than a raw total. Commits identified as AI-assisted leak secrets at roughly double the rate of commits written by developers alone, the report says. The report does not, in the summary published by The Hacker News, attribute that gap to any single cause, and the vendor frames the issue as one of identity rather than of careless typing.

The second finding concerns what is being leaked. Most of the fastest-growing categories of exposed credentials are now connected to AI systems, according to the report. In other words, the credentials that grant access to model providers, agent frameworks and related services are the ones appearing in code at an increasing pace.

That combination matters because the two trends reinforce each other. AI agents that write and commit code increase the volume of code produced, and the same agents need credentials of their own to call the services they depend on. The Hacker News summary presents secrets sprawl as an identity problem: each leaked key is, in effect, an identity that someone other than its owner can now use.

Several caveats are worth stating plainly. The figures come from a vendor that sells products in this market, and the summary does not give the absolute number of leaked secrets, the size of the sample, or the method used to classify a commit as AI-assisted. A doubled rate is a relative measure; without the base rate it does not say how many credentials were exposed in total. Nor does the source describe any confirmed breach resulting from these leaks.

For teams running coding agents, the practical reading is narrow but useful. If AI-assisted commits carry roughly twice the leak rate, the volume of code an agent can produce becomes a multiplier on exposure, not just on output. Detection that runs before code reaches a repository, short-lived credentials, and an inventory of which machine identities hold which permissions are the standard defences against this class of problem, though the report summary does not endorse a specific set of controls.

The report's broader argument is that credentials issued to software, rather than to people, are now a large and growing share of the identities an organisation has to manage \u2014 and that AI tooling has made that share harder to ignore.