Topic starter
10/07/2026 9:19 pm
TL;DR: AI-related secrets rose about 140% in one year across 11,000 anonymised customer environments, according to SentinelOne, while 88% of organisations now use AI in at least one business function, expanding the cloud attack surface and making exposed keys more likely to drive data leakage and prompt manipulation. The practical issue is no longer secret discovery alone but governed issuance, rotation, and usage control.
Editorial analysis by NHI Mgmt Group, based on content published by SentinelOne: “The Convergence of Cloud Secrets & AI Risk”.
Key questions
Q: How should security teams govern AI provider keys across multiple dashboards?
A: Security teams should centralise AI provider keys into one inventory, then attach ownership, creation time, status, and usage data so review and revocation decisions can be made consistently.
Q: Why do exposed AI secrets create more risk than ordinary cloud credentials?
A: AI secrets often sit between data sources, model access, and downstream business systems, so a single key can expose prompts, outputs, and linked datasets while also enabling access to adjacent services.
Q: What breaks when shadow AI is not included in identity governance?
A: When shadow AI is excluded, the organisation loses discovery, ownership, and enforcement at the same time.
Practitioner guidance
- Classify AI credentials as governed NHI assets Create a separate inventory class for AI API keys, map each key to an owner, business service, and approved usage boundary, and make revocation accountable to that owner.
- Collapse shadow AI into the approved inventory Identify where personal or unmanaged LLM keys are being used in support, engineering, and analytics workflows, then require those flows to move onto centrally managed credentials.
- Tie secrets review to internet-facing exposure Correlate exposed keys with misconfigured external services and legacy CVEs so remediation closes the entry point and the reachable secret at the same time.
Bottom line: AI and cloud adoption are converging into one credential-led attack surface where exposure can move from a single secret to multiple enterprise workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:42 pm
AI credential sprawl is now a governance problem, not a discovery problem. The article shows that AI-specific keys are multiplying across repositories, SaaS configurations, and internal tooling faster than conventional secrets processes can classify them. That means the control gap is no longer whether a secret exists, but whether the organisation can prove where it is issued, who owns it, and where it is allowed to operate. Practitioners should treat AI keys as a distinct NHI class with lifecycle governance, not as ordinary application secrets.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should organisations respond when a legacy vulnerability and an exposed secret are both present?
A: Treat them as one attack path, not two separate issues. Patch or isolate the external weakness while also revoking or rotating any reachable secrets connected to that host or workflow. That closes the entry point and the lateral move opportunity at the same time.
👉 Read our full editorial: AI and cloud secrets exposure is expanding the enterprise attack surface