Topic starter
22/09/2026 3:43 pm
TL;DR: Akeyless says Anthropic’s September 2026 Threat Intelligence Report shows AI compressing the path from exposed credential to enterprise compromise, including a suspected ShinyHunters affiliate scanning 1.8 million Android apps for hardcoded secrets. Static secrets now fail faster than manual remediation can respond.
Editorial analysis by NHI Mgmt Group, based on content published by Akeyless: “Anthropic’s Latest Threat Report Shows How AI Is Industrializing Secret Theft”.
Key questions
Q: What should security teams do first when hardcoded secrets are discovered in code or Git history?
A: The first step is to identify every place the secret appears, assign ownership, and revoke or rotate it before treating the finding as closed.
Q: Why do hardcoded secrets create such a large security risk?
A: Hardcoded secrets turn source code, build output, and configuration files into credential repositories, which makes exposure easy to repeat and difficult to contain.
Q: How do security teams measure whether secret scanning is actually reducing exposure?
A: Security teams should measure the time from secret creation to detection, the percentage of repositories and build artifacts scanned, and the time from detection to rotation or revocation.
Practitioner guidance
- Audit hardcoded secrets across code and history Search repositories, commit history, build artefacts, and packaged application assets for API keys, cloud tokens, and service passwords.
- Rotate and revoke exposed credentials immediately Treat every confirmed exposure as active until proven otherwise.
- Replace persistent secrets with dynamic credentials Move cloud, database, and pipeline authentication toward short-lived credentials minted on demand so there is no reusable secret to leak from code or Git history.
Bottom line: AI-assisted secret hunting turns exposed credentials into a faster compromise path, which means discovery and revocation now need to operate as one control loop.
What's in the full article
Akeyless's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step setup for the GitHub Scanner inside Akeyless Identity & Secrets Intelligence
- Control-plane details for automated rotation, revocation, and audit logging after discovery
- Implementation notes for Dynamic Secrets, Universal Secrets Connector, and GitHub history coverage
- Runtime governance detail for AI agents that should not hold static credentials
👉 Read Akeyless's analysis of AI-driven secret hunting and hardcoded secret exposure →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/09/2026 3:43 pm
AI has industrialised secret hunting, but it has not changed the underlying weakness: persistent credentials are still the easiest path to compromise. The difference is speed and scale, not root cause. When discovery is automated across public, private, and packaged code, the time between exposure and exploitation collapses to a window that manual teams cannot reliably police. The practitioner conclusion is simple: treat hardcoded secrets as a time-bound liability, not a static finding.
A few things that frame the scale:
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: When should organisations replace static secrets with ephemeral credentials?
A: Use ephemeral credentials whenever a workload can tolerate short-lived access and the secret would otherwise persist across deploys, environments, or teams. That is especially important for CI/CD pipelines, privileged APIs, and automation that touches sensitive data. Ephemeral access reduces exposure, but only if the organisation also enforces revocation and monitoring.
👉 Read our full editorial: AI-driven secret hunting is shrinking the time to enterprise compromise