TL;DR: C1.ai argues that agentic vaulting turns secrets governance into an identity control plane problem because agents authenticate on their own, request scoped credentials, and leak long-lived keys into a wider blast radius; GitGuardian found 28.65 million new secrets leaked on public GitHub in 2025, up 34% year over year. Access review processes assume credentials persist long enough to review, but agent-speed issuance collapses that window.
At a glance
What this is: This is a product-led analysis of why secrets vaulting now has to be governed like identity, with agent speed, short-lived credentials, and shadow AI discovery changing the control model.
Why it matters: IAM, PAM, and NHI teams need to treat credential issuance, approval, and revocation as one governed lifecycle when humans, workloads, and AI agents all consume secrets.
By the numbers:
- 28.65 million new secrets leaked on public GitHub in 2025, up 34% year over year, with leaked AI-service credentials up 81%.
👉 Read C1.ai's analysis of agentic vaulting and secrets governance for AI agents
Context
Secrets governance fails when credentials are treated as stored artifacts instead of access decisions. In environments where AI agents authenticate on their own and request credentials at runtime, the old model of checking out a password from a vault no longer matches how identities actually behave.
That gap is now visible in two directions. Exposed credentials still turn up in code, config files, and endpoints, while agent-driven systems create pressure to hand out broader access than least privilege can justify. For NHI, workload identity, and agentic AI programmes, the issue is no longer vault storage alone but how secrets are requested, scoped, audited, and retired.
Key questions
Q: What breaks when secrets are still governed like static credentials in agentic environments?
A: Static secrets assume a person or workflow checks out access, uses it, and later reviews it. Agentic systems can acquire and discard credentials inside the same task, so review and recertification arrive too late. Governance has to move to issuance time, where scope, expiry, and approval are enforced before the secret is ever usable.
Q: How should security teams implement short-lived credentials for AI agents?
A: Start by issuing the smallest workable token lifetime for each agent class, then verify that revocation, refresh, and logging operate across every system the agent can touch. The goal is to reduce blast radius without creating fragile workflows that fail under normal production conditions.
Q: How can security teams tell whether secret management is actually working?
A: Look for fewer plaintext secrets, narrower reuse, faster rotation, and a shrinking set of credentials that remain valid across multiple systems. If the same password or API key can still unlock several services, secret management is not yet reducing blast radius in practice.
Q: What should teams do when a secret is found outside the vault?
A: Treat it as a live identity and move it into a governed lifecycle immediately. That means revoking the exposed value, replacing it with a managed reference, and ensuring the new credential is issued under approval, scope, and audit controls. If the secret cannot be rotated cleanly, the underlying access design is still wrong.
How it works in practice
Why agent-speed secrets break person-centric vault models
Traditional vaults assume a human operator checks out a secret occasionally, uses it manually, then returns or rotates it later. Agentic systems do not behave that way. They authenticate continuously, consume credentials programmatically, and may need access across multiple tool calls or task steps. That changes the control surface from storage to issuance. Once credentials are handed out as raw reusable keys, the vault becomes a distribution point rather than a governance point, and blast radius expands when scope and lifetime are not tightly bound.
Practical implication: govern issuance, scope, and expiry as the primary control point, not just secret storage.
How workload federation changes credential handling for AI agents
Workload federation lets a signed workload identity exchange its runtime proof for a short-lived credential. The secret stays sealed in the vault, while the agent receives only a scoped token that expires on its own. That matters because it prevents the raw vault secret from entering prompts, logs, or local environments where it can be copied or reused. The architectural shift is from secret checkout to identity-backed exchange, which aligns the credential with the task rather than the actor's persistent standing access.
Practical implication: prefer identity exchange patterns that issue task-scoped credentials instead of distributing raw keys.
Why decoy credentials work in secrets-heavy environments
Decoy credentials are planted identities that should never be used by legitimate workloads. When a decoy is presented to a monitored endpoint, the system can flag the source, time, and fingerprint with high confidence. This is useful because many secrets incidents are not detected at the point of exposure but at the point of use. In agentic environments, decoys also help distinguish normal automation from unauthorised retrieval, especially when secrets may live across desktops, CI variables, and configuration files.
Practical implication: place monitored decoys on the same surfaces where real secrets tend to leak.
NHI Mgmt Group analysis
Agentic vaulting exposes a governance assumption collapse, not just a tooling gap. Traditional secrets management assumes a credential will exist long enough to be reviewed, rotated, and certified after issuance. That assumption fails when an agent can authenticate, consume, and discard access inside a single runtime task. The implication is that secrets governance must be judged at issuance time, because post-hoc review arrives after the access state has already disappeared.
Secret custody now sits on the same governance plane as identity membership. The article's most important shift is not encryption depth but access semantics: who can hold the secret, under what trust condition, and for how long. That aligns secrets handling with NHI lifecycle governance, where offboarding, scope, and revocation matter as much as storage. Practitioners should read this as a sign that vault design and identity governance can no longer be separated cleanly.
Agentic environments make long-lived secrets a liability multiplier. A reusable key does not just raise exposure, it creates a persistent control debt because every downstream tool, prompt, and endpoint that sees it becomes part of the risk surface. This is why agentic systems push governance toward short-lived, scoped credentials and away from reusable secrets that outlive the task. The decisive control question is no longer where the secret is stored, but how quickly it stops being valid.
Shadow AI discovery is now an identity inventory problem as much as a detection problem. Once discovery finds plaintext keys on laptops, config files, or CI paths, those findings become governed identities in practice because they can authorize real actions. That means inventory, custody, and offboarding must extend to secrets that were never entered into a formal IAM workflow. For practitioners, exposure discovery is only useful if it feeds an identity-style governance process.
Post-quantum protection changes the retention risk profile of stored secrets. Legacy vaults do not just protect against present-tense compromise; they also accumulate harvest-now, decrypt-later exposure if stored ciphertext remains valid for too long. That widens the problem from operational leakage to future exposure accumulation. The implication for security programmes is that vault governance now has to account for cryptographic lifespan, not only access lifecycle.
From our research library:
- Only 44% of organisations are currently using a dedicated secrets management system, according to the 2024 State of Secrets Management Survey.
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
- Read next: Guide to the Secret Sprawl Challenge
What this signals
Ephemeral credential governance: Security teams should expect secrets control to move from vault storage into runtime issuance, because agentic systems can consume access faster than recertification cycles can observe it. That makes short-lived credentials, scoped trust conditions, and revocation discipline the controls that matter most.
The risk is no longer only leakage, but leakage plus reuse across endpoints, CI paths, and agent workflows. Programmes that still rely on static vault checkout will struggle to prove least privilege when access can be created and consumed in one task.
For practitioners
- Govern secrets as access decisions Put request, approval, audit, and revocation controls around every credential class instead of treating vault storage as the control boundary.
- Replace raw key checkout with short-lived issuance Issue scoped credentials on demand through workload federation so agents and engineers never handle reusable long-lived secrets directly.
- Inventory exposed secrets discovered by shadow AI Treat plaintext keys in laptops, config files, and CI variables as governed identity material and move them into a managed lifecycle.
- Plant decoy credentials on high-risk surfaces Use monitored decoys in .env files, CI variables, and secrets managers to surface unauthorised use before it becomes a wider incident.
Key takeaways
- Agentic vaulting reframes secrets as governed access objects, not passive stored values.
- The practical risk is not just exposure, but the speed at which agents can consume and reuse credentials before controls react.
- Short-lived issuance, lifecycle governance, and decoy detection are the controls that change the outcome.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The article centers on exposed keys, leaked credentials, and secrets found by shadow AI discovery. |
| NHI-07 — Long-Lived Secrets | Agentic vaulting argues that reusable, durable credentials create the core governance problem. | |
| NHI-10 — Human Use of NHI | The post contrasts person-centric vault checkout with machine and agent access patterns. | |
| Recommendation — Scan for leaked secrets and revoke exposed credentials before they can be reused. Reduce standing secret lifetime and replace reusable credentials with short-lived issuance. Remove human-style secret checkout from agent workflows and issue task-scoped access instead. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article is about issuance, rotation, and lifecycle control of authenticators and secrets. |
| Recommendation — Apply authenticator lifecycle controls to vault-issued credentials and rotate exposed values immediately. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article treats secrets as access decisions that should be scoped and audited. |
| Recommendation — Align secret issuance with least-privilege entitlements and audit every access grant. | ||
Key terms
- Agentic Vaulting: A governance model that treats secrets as access decisions rather than static stored values. In this pattern, credentials are requested, approved, issued, and audited through identity controls so AI agents, workloads, and people receive only task-scoped access.
- Workload Federation: A credential exchange pattern where a workload proves its identity and receives a short-lived, scoped token in return. It reduces dependency on stored secrets and gives governance teams a cleaner way to bind access to workflow context, trust conditions, and revocation boundaries.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
- Decoy Credential: A decoy credential is a planted secret that looks authentic but is not meant for any legitimate workload. It is used to detect misuse quickly by triggering telemetry when an attacker, curious agent, or misconfigured process attempts to authenticate with it.
What's in the full announcement
C1.ai's full blog covers the operational detail this post intentionally leaves for the source:
- The Agentic Vault workflow for vault-and-replace of exposed credentials found by shadow AI discovery
- The workload federation pattern for issuing short-lived, scoped credentials to agents without handing out raw keys
- The post-quantum-hybrid key exchange design and what X-Wing means for vault protection
- The decoy credential handling flow, including fingerprints and high-confidence alerting
👉 C1.ai's full post covers workload federation, decoy credentials, and post-quantum vault protection.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 28, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org