AI coding agents are exposing secrets faster than policy can contain

At a glance

What this is: This is a GitGuardian webinar on hardening developer workflows for AI coding agents, with the key finding that agent-enabled development is already amplifying secret exposure and credential leakage.

Why it matters: It matters because AppSec, DevSecOps, and identity teams now have to govern AI-assisted access to code and credentials as a secrets-management and NHI problem, not just an AI-policy problem.

By the numbers:

• AI service credential leaks grew 81% year over year.

👉 Register for GitGuardian's live session on hardening developer workflows for AI coding agents

Context

AI coding agents change the access model for software delivery because they need real access to code, test data, and credentials to be useful. That makes secrets management a runtime governance problem rather than a documentation problem, especially when AI-assisted workflows increase the odds of accidental exposure. The key question is not whether developers will use agents, but whether those agents can be granted, tracked, and contained without expanding the blast radius of secrets.

In identity terms, the article sits at the intersection of human developer access, non-human identities, and agentic AI behavior. A coding agent is not just a tool that reads files; it becomes a privileged workflow participant that can touch repositories, terminals, CI contexts, and credential stores. That is why secrets governance, access scoping, and containment controls need to be treated together instead of as separate program tracks.

Key questions

Q: How should security teams control AI agents that can read secrets and modify code?

A: They should control the action boundary, not just the credential boundary. An authorised agent may be allowed to inspect code or secrets, but it should not be free to externalise data, reset permissions, or delete critical files without additional checks. The right model combines least privilege, runtime inspection, and policy enforcement before execution.

Q: Why do AI coding tools increase secrets risk?

A: AI coding tools increase secrets risk because they can accelerate the reuse of insecure patterns across repositories, test fixtures, and automation scripts. The issue is not the model inventing credentials, but the way generated code can spread bad defaults faster than human review can catch them.

Q: What do organisations get wrong about controlling AI-assisted developer workflows?

A: Many teams rely on policy language while leaving the technical access model untouched. If the agent can still read broad file paths, inherited secrets, or shared MCP connections, the policy has not reduced the actual blast radius.

Q: Who should own secret governance for coding agents?

A: Ownership should sit with identity, PAM, and platform security teams together, because the problem spans authorization, session control, and auditability. Developer teams can use the workflow, but they should not define the trust boundary. The governing question is whether access is short-lived, traceable, and revoked as soon as the task ends.

Background and context

Why AI coding agents increase secrets exposure

AI coding agents operate inside the same developer workflows that already contain high-value secrets, tokens, and environment variables. They can read files, generate code, inspect logs, and interact with repositories, which means the agent inherits the access surface of the developer session. If those controls are not narrowly scoped, the agent becomes a path for accidental disclosure rather than a productivity layer. The problem is not that the model is malicious by default, but that it is embedded in a privileged context with too much reach.

Practical implication: treat every coding agent as a bounded runtime identity and define exactly which repositories, files, and secrets it may touch.

MCP configs, secrets sprawl, and the new exposure surface

Model Context Protocol connections extend an agent's ability to use external tools and data sources, which is useful but also expands the number of places secrets can leak. Public MCP configurations are especially risky because they can expose connection details, API keys, and integration metadata that help attackers pivot from a development workflow into broader infrastructure. In practice, secrets sprawl is no longer limited to source code. It now includes agent configuration, orchestration layers, and the handoff points between tools.

Practical implication: inventory MCP and agent configuration files as part of secrets discovery, not just application code and vaults.

Containment depends on credential scope, not policy language

A written AI policy cannot stop an agent from accessing a credential that already exists in its execution path. Containment has to be enforced technically through short-lived credentials, explicit permissions, audit logging, and tight separation between human and agent privileges. That is especially important in developer tooling, where the same session often spans source control, test environments, and deployment pipelines. If those boundaries are porous, an agent can move from useful automation to unintended exfiltration very quickly.

Practical implication: use least privilege, session-level auditability, and short-lived access for any agent that can interact with secrets or build systems.

NHI Mgmt Group analysis

AI coding agents are becoming non-human identities in practice, even when organisations still treat them as mere productivity tools. Once an agent can read code, call tools, and access credentials, it needs explicit lifecycle governance: provisioning, scoping, auditing, and revocation. That is an IAM and NHI problem as much as it is an AppSec problem, because unmanaged agent access becomes a hidden privilege layer. Practitioner conclusion: govern the agent as a distinct identity class, not as an extension of the developer keyboard.

Secrets exposure is shifting from static repositories to dynamic developer workflows, which creates a new governance gap. The article's figures point to a workflow where AI assistance correlates with higher leak rates and public agent configs can contain large volumes of secrets. That changes the control objective from finding one leaked secret to reducing the number of places secrets can exist at all. Practitioner conclusion: move from reactive secret scanning to runtime containment and minimised credential scope.

Developer AI adoption is exposing a verification trust gap that conventional policy programs do not close. Organisations often assume a policy declaration is enough to control an agent's behaviour, but technical enforcement still decides what the agent can actually access. This is the same governance failure pattern seen in other identity programmes: stated intent without boundary enforcement. Practitioner conclusion: align policy, access controls, and audit evidence before scaling AI-assisted development.

Secret leakage in AI-assisted development should be treated as a lifecycle failure, not an isolated incident. Once a token, key, or MCP credential lands in a workflow, the real question is how quickly it can be discovered, rotated, and invalidated across the entire development stack. That is where identity lifecycle management, secret hygiene, and runtime monitoring intersect. Practitioner conclusion: build control ownership across AppSec, IAM, and platform engineering instead of leaving it in a single team.

Developer agent privilege drift is the emerging failure mode here. The agent starts with bounded intent but can accumulate access through integrations, cached credentials, and permissive development tooling. Over time, the environment grants more trust than the workflow originally required. Practitioner conclusion: measure and cap the privilege that accumulates around AI-enabled developer sessions.

From our research:

• The average estimated time to remediate a leaked secret is 27 days, according to The State of Secrets in AppSec.
• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
• For related context: 52 NHI Breaches Analysis shows how credential exposure and unmanaged access become breach pathways in practice.

What this signals

The practical signal for programmes is that AI-assisted development now needs the same governance discipline applied to other privileged non-human actors. Developer agent privilege drift: once access accumulates across terminals, repos, MCP links, and build systems, the control problem becomes lifecycle management rather than policy approval. Teams should align agent ownership, approval, and revocation with their existing identity and secrets governance processes.

If secret leakage already takes weeks to remediate, then agent-enabled workflows can hold risk open long after the original exposure event. That makes discovery, rotation, and containment the critical metrics, not policy adoption alone. The teams that will cope best are the ones that can prove where a secret exists, where an agent touched it, and how quickly access was removed.

For readers with IAM and NHI responsibilities, the right next step is to connect developer tooling to identity governance tooling. That means auditing agent permissions, integration scopes, and secrets lifecycle together, then mapping them to frameworks such as the NIST AI Risk Management Framework and the OWASP Agentic AI Top 10 where agent behaviour and tool misuse are in scope.

For practitioners

• Classify coding agents as bounded identities Assign each agent a named owner, an approved purpose, and a revocation path. Do not let the agent inherit all permissions from the developer session by default.
• Reduce secret reach in developer environments Remove long-lived credentials from local workstations, shared config files, and agent context wherever possible. Use short-lived tokens and separate build, test, and deploy credentials.
• Scan MCP and agent config files for secrets Include MCP configurations, agent manifests, and orchestration files in secret discovery and remediation workflows. Public config exposure is now part of the attack surface.
• Log and review agent actions at session level Capture which tools, files, and credentials each agent touches during a session so you can prove containment and investigate misuse quickly.
• Tie secret rotation to workflow exposure events Rotate credentials immediately after agent misuse, repository exposure, or public config leakage, rather than waiting for periodic cleanup cycles.

Key takeaways

• AI coding agents amplify secret exposure because they operate inside privileged developer workflows that already contain credentials.
• The core control gap is not policy absence but lifecycle failure across agent identity, secret scope, and revocation speed.
• Organisations need technical containment for agent access, or developer productivity will continue to expand the blast radius of leaked secrets.

Key terms

• AI Coding Agent Governance: The rules and oversight structures that define what a coding agent may do, why it may do it, and who is accountable for the outcome. It sits above security tooling and focuses on delegation, approval, auditability, and rollback rather than threat prevention alone.
• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Secrets Sprawl: The uncontrolled proliferation of sensitive credentials — API keys, tokens, passwords, certificates — across codebases, cloud environments, CI/CD pipelines, and configuration files. In 2024, over 50 million leaked secrets were found on the dark web.
• Agent Privilege Drift: Agent privilege drift is the gap between the access an AI agent still has and the business context that originally justified it. As tasks, prompts and workflows change, permissions can remain in place longer than they should, creating hidden exposure in production systems.

What to expect at the briefing

GitGuardian's full webinar covers the operational detail this post intentionally leaves for the source:

• A practical session on how to grant, track, and contain coding agent access in developer workflows.
• Discussion of the AI service credential leak patterns and public MCP configuration exposure behind the headline numbers.
• Concrete guidance for AppSec and DevSecOps teams that need controls beyond a policy statement.
• The live format and registration context for teams preparing to operationalise agent containment.

👉 The full GitGuardian webinar covers access-granting, tracking, and containment guidance for agent-enabled development workflows.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and agentic AI identity. It helps security practitioners connect access control, lifecycle management, and containment to the workflows their programmes actually run.