Estimated reading time: 8 minutes
Vibe-coding went mainstream in 2025, opening software development to far more people and leaving security teams to chase a growing trail of exposed secrets. A new GitGuardian report shows that as AI-assisted coding moved from niche practice to everyday workflow, leaked credentials surged across public repositories, internal systems, and developer tools. The findings point to rising AI risks for organizations that now build and ship software at much greater speed.
The report, The State of Secrets Sprawl 2026, argues that the software industry hit a turning point last year. GitGuardian found 28.76 million new hardcoded secrets in public GitHub commits in 2025, a 34% increase from the prior year. Researchers say the shift reflects a new era in which coding no longer belongs solely to engineers, and faster software development creates a rapidly expanding attack surface.
AI-Driven Development Accelerates Credential Exposure
The report highlights a sharp increase in leaked secrets tied to the growing use of AI coding assistants and automation tools. In 2025, researchers identified 28.76 million new hardcoded secrets in public GitHub commits. This represents a 34% year-over-year increase.
Researchers noted that AI-assisted development has lowered the bar for software creation. More people now write and deploy code, including those without formal engineering backgrounds.
The report states: “AI-assisted development has moved from experiment to default, and credentials are leaking at every layer of the stack.”
Many of the fastest-growing credential exposures relate to AI services, with 1,275,105 leaked AI-related secrets detected in 2025, an 81% increase from the previous year.
The surge highlights the complexity of modern AI infrastructure. Developers integrate large language models, orchestration frameworks, vector databases, and monitoring tools. Each integration adds credentials, tokens, and API keys, all of which are exploitable by attackers.
AI Coding Assistants Increase Secret Leakage Rates
The report examined how AI coding assistants shape developer behavior. AI-assisted commits leaked credentials more often, especially during early adoption.
Researchers found that commits created with the AI coding assistant Claude Code leaked secrets roughly twice as often as standard human commits in 2025.
At one point in the year, the leak rate reached 31 secrets per 1,000 commits, more than 2.4 times the human baseline.
Security researchers attribute the spike to larger AI-generated commits and rapid experimentation with new services. These larger changes increase the likelihood that credentials remain embedded in code.
Despite improvements in AI model guardrails, human oversight remains critical. Developers can still override security warnings or unintentionally commit sensitive data.
Internal Development Systems Create Hidden Risk
While public GitHub repositories get attention, the report shows the biggest risk lies within organizations.
Internal repositories are six times more likely to contain leaked secrets than public repositories. In 2025, 32.2% of internal repositories contained at least one secret. By contrast, 5.6% of public repositories had at least one leaked secret.
Security experts say this stems from a false sense of safety in corporate environments. Many teams mistakenly rely on internal systems as a protective perimeter.
Dwayne McDaniel, Senior Developer Advocate at GitGuardian, explains the underlying issue, “The illusion that there is a trusted perimeter, such as an internal repo or communications platform, where it is ‘OK’ to put plaintext secrets, has been shattered.”
From an insurance underwriting perspective, this finding changes how cyber risk should be evaluated. Internal code repositories, collaboration tools, and development pipelines now form a combined attack surface.
Underwriters may need to treat these environments as part of a unified development-risk ecosystem, rather than evaluating them separately.
Secrets Persist For Years After Exposure
One of the report’s most alarming findings concerns leaked credential lifespans. Researchers retested credentials leaked in 2022 and found that 64% remained valid in 2026, meaning attackers could still use them years later.
The report warns: leaked credentials often remain active long after exposure, making them a persistent threat. Organizations must prioritize rapid response and robust secret management to minimize long-term risks.
The researchers write: “Once a real credential leaks into a public commit, it often remains usable for far longer than any team would claim acceptable.”
Watch Cyber Insurance News Podcast
AI Risk: The Insurance Industry Faces a Faster, Bigger Ransomware Repeat
Organizations often struggle to revoke or rotate compromised credentials. Many secrets appear in multiple systems simultaneously.
McDaniel explains why remediation is so difficult, “Secrets are embedded in build systems, copied across repos, baked into containers, referenced in CI variables, and shared across teams. Rotating secrets is time-consuming.”
He says companies often delay remediation out of fear of disrupting production systems.
The report confirms this operational challenge. It found 60.4% of non-human identity issues involve long-lived credentials that should have been rotated earlier.
Collaboration Tools And Containers Expand Exposure
The report also highlights leaks outside source code repositories. Many credentials appear in collaboration tools such as Slack, Jira, and Confluence. In 2025, 28% of secret leaks occurred outside code repositories, often during troubleshooting or incident response.
These incidents often involve highly privileged credentials. Researchers found that secrets shared via collaboration tools were 13 percentage points more likely to be classified as critical than those shared in code.
Researchers identified 80,000 secrets in self-hosted GitLab and Docker registries. Of these, 10,000 contained valid credentials. These environments are especially dangerous because they are closer to production systems.
Implications For Cyber Insurance And Liability
The persistence of valid credentials raises difficult questions for cyber insurance and legal liability. Many regulatory frameworks require organizations to prevent unauthorized access and maintain audit trails. Long-lived credentials active for years can complicate incident response and insurance coverage decisions.
McDaniel notes that the report reflects a broader compliance reality. “Valid secrets that live for years, and the other policy breaches we are reporting on, increase the risk of abuse.”
Cyber insurers increasingly evaluate development pipelines and software supply chains when assessing risk. Secret management practices may become a measurable indicator of cyber hygiene.
Get The Cyber Insurance News Upload Delivered
Subscribe to our newsletter!
Security Leaders Call For Identity-Based Credential Management
The report recommends a shift away from traditional secret management toward non-human identity governance. Rather than focusing only on leaked credentials, organizations should manage machine identities across their infrastructure.
The researchers emphasize three critical questions:
- What non-human identities exist in the environment?
- Who owns them?
- What systems or data can they access?
Security teams must automate credential rotation and minimize the use of static credentials.
The report concludes that, as AI continues to accelerate code creation and increase infrastructure complexity, secrets sprawl is likely to increase. To prevent this, improved governance is necessary.
The Bottom Line: AI Risks Are Expanding The Software Attack Surface
The modern software ecosystem includes AI coding assistants, automation frameworks, and interconnected services. Each integration brings new credentials and machine identities.
The report finds that creation outpaces governance maturity, raising security risks.
For security teams, insurers, and regulators, the findings signal a shift: the next significant cyber threats may come not from malware, but from overlooked credentials embedded within the AI-driven software stack. This highlights the need to prioritize credential security.
FAQ: AI Risks And Secrets Sprawl
Section 1: Key Findings From The Report
The report shows that AI-assisted coding accelerates software creation but also expands the attack surface. More developers and automated tools generate more credentials that can leak
Vibe-coding describes rapid, AI-assisted coding that prioritizes speed and experimentation. It lowers barriers to entry but often leads to rushed workflows where credentials appear in code.
Researchers detected 28.76 million new hardcoded secrets in public GitHub commits in 2025, marking a 34% increase from the previous year.
AI applications rely on many services, including models, vector databases, orchestration tools, and monitoring systems. Each integration introduces new API keys and tokens.
Not directly. AI tools assist with coding, but developers control the final commits. Human decisions still determine whether sensitive data enters code repositories.
Section 2: Security, Insurance, And Risk Implications
Credentials often appear across build systems, containers, repositories, and CI pipelines. Rotating them can disrupt systems, so teams delay remediation.
Internal repositories are six times more likely to contain leaked secrets than public repositories.
Yes. Credentials frequently appear in collaboration tools like Slack, Jira, and Confluence during troubleshooting or incident response.
Insurers may need to evaluate internal development environments, contractor repositories, and collaboration tools as part of a single development risk surface.
Experts recommend using secrets management platforms, automating credential rotation, and shifting toward identity-based authentication instead of static credentials.
Related Cyber Liability Insurance News
- Agentic AI Cybercrime Surges 1,500% In New Flashpoint Threat Report
- Why Cyber Insurance Underwriting Is Moving Beyond Questionnaires – NEW PODCAST
- At-Bay 2025 InsurSec Rankings Reveal Email Security Weaknesses Amid Rising Cyber Insurance Claims
- All Things Cyber Liability Insurance With Travelers’ John Menefee
- “Critical Security Gap” Amid Escalating Financial Sector Cybersecurity Threats
