Topic starter
25/06/2026 12:02 am
TL;DR: Akeyless reports that Wiz found 65% of Forbes AI 50 companies leaked verified secrets across repositories, forks, gists, SaaS systems and development tools, showing that AI engineering pushes credentials into places legacy scanning and static identity controls do not cover. Static secrets fail because AI development multiplies identities faster than governance can classify or revoke them.
Editorial analysis by NHI Mgmt Group, based on content published by Akeyless: “What the Wiz Report Reveals About AI Secrets (And Why Scanning Won’t Fix It)”.
Key questions
Q: What breaks when CI/CD pipelines rely on static secrets?
A: Static secrets create a reusable attack path into production infrastructure.
Q: Why do developer environments increase the risk of credential theft?
A: Developer environments often sit close to source repositories, cloud consoles, and administrative tooling, so one compromise can expose both human and non-human identities.
Q: How do security teams know when secret sprawl is becoming unmanageable?
A: When they cannot confidently answer where each secret exists, which workloads depend on it, and how quickly it can be retired without breaking business services.
Practitioner guidance
- Expand secret discovery coverage Add notebooks, logs, deleted forks, contributor repositories, extensions and support portals to your discovery scope so AI-era credential exposure is not hidden outside source control.
- Classify AI service credentials as NHI assets Assign ownership, scope and expiry to tokens used by model pipelines, orchestration layers and connectors instead of leaving them as informal developer secrets.
- Replace reusable credentials with short-lived access Use ephemeral, task-scoped credentials for AI workflows so a leaked token cannot survive long enough to be copied into notebooks, prompts or support cases.
Bottom line: AI development is expanding the credential surface far beyond source code, which makes conventional scanning incomplete on its own.
What's in the full article
Akeyless's full article covers the operational detail this post intentionally leaves for the source:
- The specific surfaces Wiz examined, including commit histories, gists, deleted forks and contributor repositories
- The five takeaways Akeyless draws from the Wiz findings for teams handling AI secrets at scale
- The examples of AI tooling and SaaS systems where credentials surfaced outside traditional scanning paths
- The product-facing approach to secretless, just-in-time access for AI agents and development workflows
👉 Read Akeyless's analysis of AI secrets sprawl and identity control gaps →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:50 am
AI secrets sprawl is an identity governance failure, not a scanning failure. The article shows that the problem extends across notebooks, logs, gists, support portals, extensions and personal repositories, which means discovery alone cannot keep pace with how AI teams create and move credentials. The field should stop treating these exposures as isolated hygiene issues and start treating them as evidence of unmanaged identity proliferation.
A few things that frame the scale:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to the Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do when AI credentials are found outside approved systems?
A: Teams should revoke the exposed credential, trace where it was replicated, and determine which workloads, agents or integrations depended on it. The real task is to remove standing reuse and reissue access through a governed lifecycle, otherwise the same secret will reappear in the next notebook, ticket or workflow.
👉 Read our full editorial: AI secrets sprawl is outpacing legacy identity controls