Topic starter
15/04/2026 3:15 pm
TL;DR: GitGuardian reports 28,649,024 new secrets in public GitHub commits in 2025, a 34% year-over-year increase, alongside 1,275,105 exposed AI-service secrets and 81% growth in AI-related leaks. The issue is no longer just developer hygiene: AI tooling is multiplying NHI creation and making lifecycle governance the limiting control.
Editorial analysis by NHI Mgmt Group, based on content published by GitGuardian: “When We Use AI To Ship Fast, Secrets Spread Fast”.
By the numbers:
- Publicly active developers on GitHub grew 33% in 2025, while 54% of active developers made their first commit that year.
Key questions
Q: What breaks when AI service secrets are treated like ordinary developer artifacts?
A: Secrets become distributed faster than governance can track them.
Q: Why do AI pipelines expose more credential risk than traditional software development?
A: AI pipelines create more identities, more integrations, and more temporary execution paths than conventional software delivery.
Q: How can security teams tell whether secret management is actually working?
A: Look for fewer plaintext secrets, narrower reuse, faster rotation, and a shrinking set of credentials that remain valid across multiple systems.
Practitioner guidance
- Establish a full inventory of AI-related NHIs Catalog model API keys, orchestration tokens, retrieval service credentials, database connections, and agent tool accounts with named owners and business purpose.
- Block hardcoded secrets before merge Use pre-commit and CI checks to stop credentials from entering repositories, and require approved secret issuance for AI application code.
- Shorten the lifetime of AI service credentials Set explicit expiry, rotation, and revocation rules for every AI service secret, especially those embedded in prototypes, scripts, and sample configurations.
Bottom line: AI-driven development is turning secrets management into a lifecycle governance problem because the number of machine identities is rising faster than most teams can track them.
What's in the full report
GitGuardian's full article covers the operational detail this post intentionally leaves for the source:
- Breakdowns of the fastest-growing AI service secret types and the specific platforms they map to.
- The MCP configuration findings, including which secret types appear most often in exposed files.
- The AI-assisted commit data that shows how code production speed affects secrets leakage patterns.
- The policy-breach distribution that explains where lifecycle controls are failing most often.
👉 Read GitGuardian's analysis of AI-driven secrets sprawl and enterprise governance gaps →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
07/10/2026 6:11 pm
AI-driven secrets sprawl is really identity sprawl. The article shows that leaked credentials are not rising only because developers are busier. They are rising because AI-heavy software now depends on more service accounts, API keys, tokens, and orchestration credentials than traditional application stacks. That is a lifecycle problem, not a tooling problem. The practical conclusion is that secrets management must be governed as NHI lifecycle management across the software delivery path.
A few things that frame the scale:
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded, according to the State of Secrets Sprawl 2026.
- 8 of the top 10 fastest-growing types of leaked secrets year-over-year are tied directly to AI services, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What breaks when cyber asset visibility is fragmented across too many tools and data sources?
A: Fragmented visibility makes it harder to understand relationships, prioritize the right assets, and respond quickly during an incident. Teams can miss connections between cloud assets, users, and dependencies, which slows analysis and increases the chance that important risks stay buried. In practice, fragmentation turns asset data into noise instead of usable context.
👉 Read our full editorial: AI-driven secrets sprawl is outpacing enterprise governance