The Observation
AI coding assistants are boosting software speed, but they have created a massive security gap. In 2025, we saw 28.65 million hardcoded secrets show up in public GitHub commits. That is a 34 percent year-over-year increase, the biggest jump on record.
The Analysis
Developers using these automated tools are accidentally baking credentials into their code at a frantic pace. AI-assisted commits leak secrets at a 3.2 percent rate, which is more than double the 1.5 percent rate we see with human-only work. New frameworks are also creating blind spots. We have seen over 24,000 unique secrets exposed just via Model Context Protocol configuration files because documentation now treats putting API keys in plaintext as normal. Code that ships faster but carries more vulnerabilities is just undermining your entire security posture.
The Tactical Step
Run automated secret scanning on every repository before code hits a public or internal environment. Treat AI-generated code with maximum scrutiny during reviews, specifically hunting for API keys, database credentials and access tokens. If a secret leaks, rotate the credentials immediately instead of just trying to scrub the commit history.
Question for the network
Is your engineering team blindly trusting the code their AI assistants generate, or do you have automated gates to stop hardcoded secrets before they go public?
References
- GitGuardian: State of Secrets Sprawl 2026
- Info2soft: AI Data Loss & Security Statistics 2026
By Michael Lennard Gnaedinger. © 2026 Gnaedinger Consultancy. All rights reserved.
If any of this sounds familiar.
I work with a small number of founders and CEOs each year. The conversation starts here.