Over 29 million secrets were leaked on GitHub in 2025, and AI really isn't helping

Date:
Wed, 18 Mar 2026 16:00:00 +0000

Description:
AI seems to be making things worse, as vibe-coded commits leave hardcoded credentials and other vulnerabilities.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Tech Radar Get the TechRadar Newsletter Sign up for
breaking news, reviews, opinion, top tech deals, and more. Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over. You are
now subscribed Your newsletter sign-up was successful An account already exists for this email address, please log in. Subscribe to our newsletter GitGuardian report warns AI-driven coding leaks secrets at record pace 2025 saw 29M exposed credentials on GitHub, +34% YoY jump AI-assisted commits double baseline leak rates, with MCP configs fueling exposures Vibe-coding
may seem great for quickly shipping products, but inexperienced developers
are leaving gaping cybersecurity holes that are causing breaches and
exposures left and right. This is according to GitGuardians latest report,
the State of Secrets Sprawl paper that was just released.

In the research document, the organization said 2025 was the year when AI adoption permanently changed software engineering. That year, there was a 43% increase year-on-year in public commits, growing at least two times faster than before. An increase in commits also means an increase in secrets and since 2021, these have been growing roughly 1.6 times faster than the active developer population. Also, secret leak rates in AI-assisted code were
roughly double the GitHub-wide baseline. Article continues below You may like Shock report claims Android apps have leaked over 730TB of user data and Google secrets - here are some of the worst offenders around Security experts flag multiple issues in Claude Code, warning, 'As AI integration deepens, security controls must evolve to match the new trust boundaries' Average organization now reporting over 200 GenAI-related data policy violations each month ClaudeCode, MCP configurations, and other risks Together, these forces drove a +34% YoY increase in newly leaked secrets on GitHub, reaching ~29 million secrets detected overall, marking the largest single-year jump ever recorded, the organization said in a press release.

Of all the different vulnerabilities that can be found in AI-generated code, exposed credentials remain the biggest path to compromise, GitGuardian says. Commits built with Claude Code apparently leaked secrets at roughly 3.2%
which is two times the baseline, and AI service credentials leaks seem to be accelerating the fastest. Leaks tied to AI services spiked 81% year-on-year, and are more likely to slip through protections.

GitGuardian specifically singled out Model Context Protocol (MCP) configuration risk. The report says that MCP server documentation often recommends putting credentials in configuration files, which is a risky pattern that contributed to more than 24,000 secrets being exposed.

The paper further explained that internal repositories are six times more likely to contain hardcoded secrets, compared to public ones, and stressed that more than a quarter (28%) of incidents originate from leaks in collaboration and productivity tools. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me
with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

Finally, with AI agents getting deeper local access, prompt injection and supply-chain attacks are getting more disruptive:

AI agents need local credentials to connect across systems, turning developer laptops into a massive attack surface. We built our local scanning and identities inventory tool to protect them. Security teams need to map out exactly which machines hold which secrets, surfacing critical weaknesses like overprivileged access and exposed production keys. said Eric Fourrier, GitGuardian CEO. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.



======================================================================
Link to news story: https://www.techradar.com/pro/security/over-29-million-secrets-were-leaked-on- github-in-2025-and-ai-really-isnt-helping


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)