TL;DR: Akeyless reports that Wiz found 65% of Forbes AI 50 companies leaked verified secrets across repositories, forks, gists, SaaS systems and development tools, showing that AI engineering pushes credentials into places legacy scanning and static identity controls do not cover. Static secrets fail because AI development multiplies identities faster than governance can classify or revoke them.
At a glance
What this is: This analysis argues that AI secrets sprawl is less a repository hygiene problem than an identity governance failure, because credentials now appear across notebooks, logs, extensions, support portals and other surfaces legacy controls miss.
Why it matters: IAM, IGA, PAM and NHI teams need to treat AI development as an expanding identity estate, where static credentials and incomplete discovery leave both humans and machine identities exposed.
👉 Read Akeyless's analysis of AI secrets sprawl and identity control gaps
Context
AI secrets sprawl occurs when credentials, tokens and API keys are created, copied and exposed across many development and collaboration surfaces, not just source repositories. In this article, the governance problem is that traditional IAM and secrets-management models assume a stable identity set and predictable control points, while AI-driven engineering continuously creates new machine identities and new places for those credentials to persist.
The article's core finding is that AI development has widened the identity surface beyond what conventional scanning and lifecycle processes were designed to govern. That matters for NHI, because these leaked credentials often belong to model pipelines, connectors, orchestration layers and other non-human actors that behave like first-class identities even when teams still manage them as leftover secrets.
Key questions
Q: What breaks when CI/CD pipelines rely on static secrets?
A: Static secrets create a reusable attack path into production infrastructure. Once they are copied into workflow files, logs, runner images, or environment variables, a single compromise can expose broad access long after the original job finishes. That is why pipeline secrets should be treated as production identity, not temporary configuration.
Q: Why do developer environments increase the risk of credential theft?
A: Developer environments often sit close to source repositories, cloud consoles, and administrative tooling, so one compromise can expose both human and non-human identities. Stored credentials, cookies, and tokens are especially valuable because they can be replayed or used to pivot into deeper systems with little friction.
Q: How do security teams know when secret sprawl is becoming unmanageable?
A: When they cannot confidently answer where each secret exists, which workloads depend on it, and how quickly it can be retired without breaking business services. If the answer requires manual archaeology across code, tickets, and pipelines, the sprawl is already beyond routine control.
Q: What should teams do when AI credentials are found outside approved systems?
A: Teams should revoke the exposed credential, trace where it was replicated, and determine which workloads, agents or integrations depended on it. The real task is to remove standing reuse and reissue access through a governed lifecycle, otherwise the same secret will reappear in the next notebook, ticket or workflow.
Technical breakdown
Why AI development expands the secret exposure surface
AI engineering introduces more places for credentials to exist because every notebook, connector, orchestration step, support interaction and extension can carry a token or API key. Unlike a traditional application release path, these environments create transient artefacts such as logs, scratch files, forks and personal repositories that outlive the immediate task. The result is a distributed exposure model, where discovery has to span code, collaboration tooling and runtime systems. The real problem is not just that secrets exist, but that they are replicated across surfaces security teams rarely inventory end to end.
Practical implication: expand discovery beyond repositories to include notebooks, logs, extensions and SaaS support surfaces.
Why static secrets break down in AI pipelines
Static credentials assume that access can be issued once, tracked centrally and rotated before reuse. AI pipelines break that assumption because tasks are short-lived, highly iterative and frequently delegated across services. A model workflow can touch multiple endpoints, each requiring its own authentication material, while generated code and automation can copy those credentials into places scanners miss. That makes long-lived secrets both hard to govern and easy to reuse across contexts. In NHI terms, the control failure is not merely leakage, but the persistence of reusable privilege in a fast-moving workflow.
Practical implication: replace durable credentials in AI workflows with short-lived, task-scoped access.
How machine identity growth changes governance assumptions
AI-native environments generate machine identities at a pace that legacy IAM was not built to classify. Each agent, model endpoint, evaluation system or service-to-service connection creates new authentication material, new owners and new lifecycle questions. Traditional governance assumes the identity population is relatively stable and that access reviews can keep pace with it. AI changes that by making identity creation continuous and often ephemeral. The consequence is governance drift: credentials appear faster than teams can assign ownership, monitor use or retire access. This is a lifecycle problem as much as a security problem.
Practical implication: classify AI-related machine identities as governed assets with explicit ownership and offboarding.
Threat narrative
Attacker objective: The objective is to reuse exposed AI-era credentials to reach proprietary models, datasets, orchestration systems or wider enterprise access.
- Entry occurs when secrets are embedded in repositories, notebooks, extensions, gists or support portals that are outside normal scanning paths.
- Credential harvesting follows when attackers or insiders collect API keys, model tokens and service credentials from those exposed surfaces.
- Impact follows when the stolen credentials unlock model pipelines, enterprise data, or privileged SaaS access tied to AI operations.
Breaches seen in the wild
- Secrets in VS Code extensions 2025: Wiz found 550+ secrets in VS Code extensions, including publishing tokens able to push malicious updates to about 150,000 installs.
- Hugging Face Spaces breach 2024: Unauthorised access to Hugging Face Spaces may have exposed secrets users stored for AI apps; tokens were revoked and org tokens removed.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
AI secrets sprawl is an identity governance failure, not a scanning failure. The article shows that the problem extends across notebooks, logs, gists, support portals, extensions and personal repositories, which means discovery alone cannot keep pace with how AI teams create and move credentials. The field should stop treating these exposures as isolated hygiene issues and start treating them as evidence of unmanaged identity proliferation.
Static credential governance was designed for slower systems than AI development. Access review cadences assume credentials remain stable long enough to be reviewed and remediated, but AI pipelines generate, copy and discard access paths continuously. That makes short-lived machine activity structurally mismatched to controls built around periodic certification. Practitioners need to recognise that the control assumption, not just the implementation, is outdated.
Ephemeral credential trust debt is the right concept for this pattern. AI teams accumulate risk every time a transient token is created in one tool and reused in another without a governed lifecycle. The issue is not just leakage, but the hidden obligation to account for access that never had a clean ownership chain. NHI programmes should treat this as a governance debt problem, not merely a secrets-management backlog.
Machine identities now need the same lifecycle discipline that human identities already receive. Every agent, connector and orchestration layer creates access relationships that should be owned, reviewed and retired. If those identities remain implicit, the organisation cannot prove who can reach what, or why. The implication is a shift from repository-centric controls to lifecycle governance across humans, machines and AI workflows.
From our research library:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to the Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to the Ultimate Guide to NHIs.
- Read next: Guide to the Secret Sprawl Challenge
What this signals
AI secrets sprawl will keep outpacing traditional controls until teams stop treating credentials as repository-bound artefacts. The next control boundary has to include notebooks, support portals, extensions and orchestration layers, because that is where AI systems now leak privilege. According to the Ultimate Guide to NHIs, 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
The practical shift is toward governed issuance, not broader scanning. When ephemeral access replaces reusable credentials, the security programme gains a chance to reduce blast radius before secrets propagate into collaboration surfaces.
Ephemeral credential trust debt: every temporary token that is created without explicit ownership, scope and expiry adds hidden future remediation work. Teams that cannot account for that debt will keep discovering credentials after the fact rather than preventing their spread.
For practitioners
- Expand secret discovery coverage Add notebooks, logs, deleted forks, contributor repositories, extensions and support portals to your discovery scope so AI-era credential exposure is not hidden outside source control.
- Classify AI service credentials as NHI assets Assign ownership, scope and expiry to tokens used by model pipelines, orchestration layers and connectors instead of leaving them as informal developer secrets.
- Replace reusable credentials with short-lived access Use ephemeral, task-scoped credentials for AI workflows so a leaked token cannot survive long enough to be copied into notebooks, prompts or support cases.
- Map service-to-service dependencies Inventory every agent, model endpoint, vector database and SaaS integration that can authenticate to another system, then define the minimum access each one actually requires.
Key takeaways
- AI development is expanding the credential surface far beyond source code, which makes conventional scanning incomplete on its own.
- The article's core evidence shows that secrets appear in collaboration tools, support systems and runtime artefacts, not just repositories.
- Teams need governed, short-lived access for AI workflows if they want to reduce reuse and limit the impact of leaked credentials.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The article centres on secrets surfacing in repos, notebooks, logs and SaaS surfaces. |
| NHI-07 — Long-Lived Secrets | Static credentials are the control failure the article argues AI environments expose. | |
| NHI-05 — Overprivileged NHI | The article notes that several leaked credentials had broad organisation-level permissions. | |
| Recommendation — Scan AI workflows for secret leakage and remove exposed credentials from all collaboration surfaces. Replace long-lived AI credentials with short-lived access that expires after each task. Review AI-related identities for unnecessary privileges and reduce access scope to the minimum. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | AI credentials need explicit entitlement governance across humans, machines and workflows. |
| Recommendation — Map AI workflow credentials to PR.AA-05 and verify every entitlement has a defined owner and scope. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | Leaked secrets create credential-access and exfiltration pathways in AI environments. |
| Recommendation — Hunt for exposed credentials as a credential-access precursor and monitor for exfiltration from collaboration tools. | ||
Key terms
- Secrets Sprawl: The uncontrolled proliferation of sensitive credentials, API keys, tokens, passwords, certificates, across codebases, cloud environments, CI/CD pipelines, and configuration files. In 2024, over 50 million leaked secrets were found on the dark web.
- Ephemeral Credentials: Ephemeral credentials are short-lived access artefacts issued for a limited task or session. They reduce the window for abuse, but they only improve security when paired with strong scope limits, telemetry, and automatic revocation at task completion.
- Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
- Identity Surface: The identity surface is the full set of credentials, tokens, tool permissions, and delegated identities an AI agent can use during execution. It matters because agents often do not operate through a single account, and partial visibility into that surface creates false confidence about control coverage.
What's in the full article
Akeyless's full article covers the operational detail this post intentionally leaves for the source:
- The specific surfaces Wiz examined, including commit histories, gists, deleted forks and contributor repositories
- The five takeaways Akeyless draws from the Wiz findings for teams handling AI secrets at scale
- The examples of AI tooling and SaaS systems where credentials surfaced outside traditional scanning paths
- The product-facing approach to secretless, just-in-time access for AI agents and development workflows
👉 Akeyless's full article covers the Wiz findings, exposed surfaces and the shift to ephemeral access.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org