Topic starter
28/07/2026 6:14 pm
TL;DR: C1.ai argues that agentic vaulting turns secrets governance into an identity control plane problem because agents authenticate on their own, request scoped credentials, and leak long-lived keys into a wider blast radius; GitGuardian found 28.65 million new secrets leaked on public GitHub in 2025, up 34% year over year. Access review processes assume credentials persist long enough to review, but agent-speed issuance collapses that window.
Editorial analysis by NHI Mgmt Group, based on content published by C1.ai: “Introducing Agentic Vault: govern every secret like an identity”.
By the numbers:
- 28.65 million new secrets leaked on public GitHub in 2025, up 34% year over year, with leaked AI-service credentials up 81%.
Key questions
Q: What breaks when secrets are still governed like static credentials in agentic environments?
A: Static secrets assume a person or workflow checks out access, uses it, and later reviews it.
Q: How should security teams implement short-lived credentials for AI agents?
A: Start by issuing the smallest workable token lifetime for each agent class, then verify that revocation, refresh, and logging operate across every system the agent can touch.
Q: How can security teams tell whether secret management is actually working?
A: Look for fewer plaintext secrets, narrower reuse, faster rotation, and a shrinking set of credentials that remain valid across multiple systems.
Practitioner guidance
- Govern secrets as access decisions Put request, approval, audit, and revocation controls around every credential class instead of treating vault storage as the control boundary.
- Replace raw key checkout with short-lived issuance Issue scoped credentials on demand through workload federation so agents and engineers never handle reusable long-lived secrets directly.
- Inventory exposed secrets discovered by shadow AI Treat plaintext keys in laptops, config files, and CI variables as governed identity material and move them into a managed lifecycle.
Bottom line: Agentic vaulting reframes secrets as governed access objects, not passive stored values.
What's in the full announcement
C1.ai's full blog covers the operational detail this post intentionally leaves for the source:
- The Agentic Vault workflow for vault-and-replace of exposed credentials found by shadow AI discovery
- The workload federation pattern for issuing short-lived, scoped credentials to agents without handing out raw keys
- The post-quantum-hybrid key exchange design and what X-Wing means for vault protection
- The decoy credential handling flow, including fingerprints and high-confidence alerting
👉 Read C1.ai's analysis of agentic vaulting and secrets governance for AI agents →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:57 pm
Agentic vaulting exposes a governance assumption collapse, not just a tooling gap. Traditional secrets management assumes a credential will exist long enough to be reviewed, rotated, and certified after issuance. That assumption fails when an agent can authenticate, consume, and discard access inside a single runtime task. The implication is that secrets governance must be judged at issuance time, because post-hoc review arrives after the access state has already disappeared.
A few things that frame the scale:
- Only 44% of organisations are currently using a dedicated secrets management system, according to the 2024 State of Secrets Management Survey.
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do when a secret is found outside the vault?
A: Treat it as a live identity and move it into a governed lifecycle immediately. That means revoking the exposed value, replacing it with a managed reference, and ensuring the new credential is issued under approval, scope, and audit controls. If the secret cannot be rotated cleanly, the underlying access design is still wrong.
👉 Read our full editorial: Agentic vaulting reframes secrets governance for AI agents