Notifications
Clear all
Topic starter
09/07/2026 12:34 pm
TL;DR: AI coding agents automatically ingest environment variables, config files, APIs, repositories, and MCP tooling, expanding credential exposure across the IDE and cloud stack, according to Knostic. That turns token scope, rotation, and boundary enforcement into core identity governance work, not optional hardening.
NHIMG editorial — based on content published by Knostic: AI coding agent credentials management and credential sprawl
By the numbers:
- More than 12.7 million hard-coded secrets were detected in public GitHub commits in 2023.
- Compromised account credentials accounted for 27% of initial malicious access events.
- 46% of security teams report spending more time maintaining their tools than actively defending their organization.
Questions worth separating out
Q: How should security teams manage credentials used by AI coding agents?
A: Treat the agent as a non-human identity with tightly bounded access.
Q: Why do AI coding agents make credential sprawl worse?
A: They automatically inspect files, environment variables, APIs, and metadata to complete work, which lets secrets enter the agent's context without explicit user action.
Q: What breaks when AI coding agents use long-lived shared tokens?
A: Shared tokens create broad, persistent access that outlives any single task.
Practitioner guidance
- Inventory every credential path an agent can touch Map files, environment variables, cloud keys, API tokens, CI/CD secrets, and MCP credentials that can enter an AI coding agent's context.
- Issue task-scoped tokens instead of shared developer credentials Create separate credentials for read, write, test, and deploy workflows so the agent never inherits a broad token from a person or another tool.
- Enforce boundary checks at the IDE layer Use IDE controls or wrappers to block access to unnecessary files, redact visible secrets, and log every request the agent makes.
What's in the full article
Knostic's full blog covers the implementation detail this post intentionally leaves for the source:
- IDE-level boundary controls that redact secrets before an agent can ingest them
- Practical token scoping patterns for read, write, test, and deploy workflows
- Rotation and revocation triggers tied to repository changes, environment changes, and anomaly detection
- Kirin-specific policy examples for controlling what an agent can read, write, or execute
👉 Read Knostic's analysis of AI coding agent credentials management →
AI coding agent credentials sprawl: are your controls keeping up?
Explore further
09/07/2026 12:38 pm
Credential sprawl is the real identity failure mode in AI coding environments. The article shows that agents ingest secrets from files, APIs, IDE metadata, and cloud tooling without explicit user action, which turns ordinary development artefacts into identity-bearing attack surface. The issue is not just leakage, but uncontrolled propagation across multiple tools and integrations. Practitioners should treat every new agent plugin as another credential boundary to govern.
A few things that frame the scale:
- More than 12.7 million hard-coded secrets were detected in public GitHub commits in 2023, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- Compromised account credentials accounted for 27% of initial malicious access events, according to Kroll's Q4 2024 Cyber Threat Intelligence Report.
A question worth separating out:
Q: What should teams review before allowing new MCP tools or IDE plugins?
A: Review the credential path, the permission scope, and the revocation path before the tool is enabled. If the integration needs broad access or cannot be cleanly revoked, it will expand the agent's blast radius and weaken identity governance across the development workflow.
👉 Read our full editorial: AI coding agent credentials management is now an IAM problem
