The Real Problem Isn't That AI Can't Write Secure Code - It's That It's Expanding Attack Surface
Summary: GitGuardian's research found 28.65 million new hardcoded secrets in public GitHub commits in 2025, a 34% year-over-year increase and the largest single-year jump the report has recorded, with 1,275,105 leaked secrets tied to AI services, up 81%. Claude Code co-authored commits grew from 22 in January 2025 to 2.16 million by December and leaked a secret 3.2% of the time against a 1.5% baseline, while analysis of the Shai-Hulud 2 attack across 6,943 compromised machines found 294,842 secret occurrences, 33,185 unique secrets, and at least 3,760 still valid, with 59% of those machines being CI/CD runners rather than developer laptops.
What's compelling: Each live secret on a compromised machine appeared in roughly eight different locations, so removing one copy leaves the others in place, and with 59% of the affected machines being shared CI/CD runners, a single leaked credential can unlock pipelines and deployment paths used by multiple teams.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026