Secrets Sprawl Is an Identity Problem That AI Just Made Impossible to Ignore

Summary: GitGuardian's 2026 State of Secrets Sprawl Report found that commits identified as AI-assisted leak secrets at roughly twice the rate of human-written ones, and most of the fastest-growing categories of leaked credentials are tied to AI services. The article attributes this to coding agents that can read entire projects, execute commands, call APIs and modify configurations, spreading credentials across more systems than teams can inventory and rotate. A Keeper Security RSAC 2026 survey cited in the piece found 46% of respondents said AI-powered tools have access to critical systems and sensitive data, while 76% said those identities are not consistently governed under privileged access policies.
What you should know: Rotating the copy of a secret found in a repository leaves the other copies working, and a large share of secret incidents can originate outside code repositories entirely, in collaboration and ticketing tools. With 76% of surveyed organizations not consistently governing AI identities under privileged access policies, the orchestrator holding keys for several agents is the single identity whose compromise cascades.

Read the original at The Hacker News ↗