AI Agent Secrets Statistics 2026

This page is a dated compilation of primary-source figures for AI agent secrets statistics 2026. It is not product copy. GitHub-wide leak volume is compiled on Credential Leak Statistics 2026.

Key takeaways

• AI-assisted commits leaked secrets at 3.2% versus a 1.5% public-GitHub baseline (GitGuardian, 2026).
• 65% of scanned Forbes AI 50 companies with a GitHub presence had a verified secret leak (Wiz, 2025).
• 3.1% of sampled LLM agent skills (520 of 17,022) contained credential leakage, totaling 1,708 issues (Chen et al., 2026).
• 44% of machines in GitGuardian’s Shai-Hulud 2 analysis held more than 10 secrets (GitGuardian, 2026).
• 59% of machines in GitGuardian’s Shai-Hulud 2 analysis were CI/CD runners (GitGuardian, 2026).
• GitGuardian detected 1,275,105 leaked AI-service secrets in 2025 (GitGuardian, 2026).
• GitGuardian found 24,008 unique secrets in MCP-related configuration files on public GitHub in 2025 (GitGuardian, 2026).
• Debug logging accounted for 73.5% of credential-leakage issues in sampled agent skills (Chen et al., 2026).
• 76.3% of credential-leakage cases in the skill study required joint analysis of natural-language descriptions and executable code (Chen et al., 2026).
• Secrets deleted from 107 upstream skill repositories remained live across 50+ independent forks (Chen et al., 2026).
• LLM infrastructure leaked 5× faster than core model providers in 2025 (GitGuardian, 2026).
• 89.6% of leaked credentials in that skill sample were immediately exploitable (Chen et al., 2026).

How this page was compiled

Primary sources only. Other “statistics 2026” roundups are not sources. News posts were used as pointers, never as the cited authority. When two primaries disagree, both are kept and the difference is labeled. Empty headings mean no primary source was verified.

How many secrets do AI coding tools and agents leak?

65% of scanned Forbes AI 50 companies with a GitHub presence had a verified secret leak. Wiz scanned private companies on the Forbes AI 50 list, excluding firms with no GitHub footprint, using commit history, deleted forks, gists, workflow logs, and contributor repos. The companies with verified leaks were valued at over $400 billion. This is a company-level leak rate, not a per-commit rate. Source: Wiz, Exposure Report: 65% of Leading AI Companies Found with Verified Secret Leaks, November 2025. link

3.1% of sampled LLM agent skills (520 of 17,022) contained credential leakage, totaling 1,708 issues. Researchers drew a stratified random sample from 170,226 skills on SkillsMP and ran static analysis, sandbox tests with mock credentials, and manual review. After disclosure, all 83 confirmed malicious skills were removed and 91.6% of hardcoded-credential cases were remediated. Source: Chen et al., How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study, arXiv:2604.03070, April 2026 (v2 June 2026). link

44% of machines in GitGuardian’s Shai-Hulud 2 analysis held more than 10 secrets; 5% held more than 100. GitGuardian treated the Shai-Hulud 2 supply-chain attack dataset as a window onto developer endpoints, not as a survey of ARCA users. Across 6,943 compromised machines it reported 294,842 secret occurrences and 33,185 unique secrets. Source: GitGuardian, The State of Secrets Sprawl 2026, March 2026. link

59% of those machines were CI/CD runners rather than personal workstations. Same Shai-Hulud 2 set as above. Source: GitGuardian, The State of Secrets Sprawl 2026, March 2026. link

Public-GitHub secret volume is compiled on Credential Leak Statistics 2026.

How much higher is the leak rate for AI-assisted commits?

Claude Code co-authored commits leaked secrets at 3.2%, versus a 1.5% baseline across public GitHub commits in 2025. GitGuardian compared commits identified via Claude Code “Co-Authored” trailers against the 1.94 billion public commits it scanned in 2025. The year-average gap is about 2×. The report states that developers remain in control of what is accepted, edited, ignored, or pushed. Source: GitGuardian, The State of Secrets Sprawl 2026, March 2026. link

How many AI-service API keys are exposed each year?

GitGuardian detected 1,275,105 leaked AI-service secrets in 2025, up 81% from 2024. The count covers public GitHub detections for AI-service detectors, not a census of every AI vendor. Eight of the ten fastest-growing detectors were tied to AI services. Source: GitGuardian, The State of Secrets Sprawl 2026, March 2026. link

LLM infrastructure (orchestration, RAG, vector storage) leaked 5× faster than core model providers. One named example is 113,000 leaked DeepSeek API keys in 2025. Source: GitGuardian, The State of Secrets Sprawl 2026, March 2026. link

How often do MCP config files contain live secrets?

GitGuardian found 24,008 unique secrets in MCP-related configuration files on public GitHub in 2025, including 2,117 unique valid credentials (8.8%). The unit is unique secrets in MCP-related configs, not the share of all MCP files. 14% of secrets leaked in those files were PostgreSQL database connection strings.

Rank	Valid unique secret type in MCP configs	Share
1	Google API key	19.2%
2	PostgreSQL connection string	14%
3	Firecrawl API key	11.9%
4	Perplexity API key	11.2%
5	Brave Search API key	11%

Source: GitGuardian, The State of Secrets Sprawl 2026, March 2026. link

Wiz separately reported an enterprise-tier ElevenLabs API key in plaintext mcp.json at one Forbes AI 50 company. That is a case, not a rate. Source: Wiz, Exposure Report: 65% of Leading AI Companies Found with Verified Secret Leaks, November 2025. link

What leaks into AI coding session transcripts?

Debug logging accounted for 73.5% of credential-leakage issues in the sampled agent skills, because agent frameworks feed stdout into the LLM context window. The 73.5% share is of the 1,708 issues found in 520 affected skills, not of all coding sessions. print / console.log was the dominant vector in that study. Source: Chen et al., How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study, arXiv:2604.03070, April 2026. link

No primary source verified as of 13 September 2026 published a count of secrets appearing in commercial IDE or coding-assistant session transcripts (Cursor, Claude Code, Copilot chat logs) as a standalone corpus. Anthropic printed individual prompts that contained live access credentials in traffic forwarded to Claude. Those examples are in the prompts section below. They do not replace that missing census. Source: Anthropic, Detecting and countering misuse of AI: September 2026, September 2026. link

How many secrets appear in AI prompts?

76.3% of credential-leakage cases in the skill study required joint analysis of natural-language descriptions and executable code; 3.1% of cases arose from natural language alone via prompt injection. The population is the leakage cases inside the 17,022-skill sample, not a count of production prompts. The 3.1% NL-only share is not the same statistic as the 3.1% of skills that contained any leakage. Source: Chen et al., How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study, arXiv:2604.03070, April 2026. link

Anthropic printed a developer prompt, submitted to a PRC lab coding assistant and forwarded to Claude, that contained a Telegram bot token, a Feishu app secret, and a Notion integration key. That is one documented prompt in forwarded traffic, not a census of production prompts and not a replacement for the missing commercial IDE transcript census. Source: Anthropic, Detecting and countering misuse of AI: September 2026, September 2026. link

How many enterprises share API keys across agents?

No primary source verified as of 13 September 2026.

Which files most often expose developer secrets in agent workflows?

No primary source verified as of 13 September 2026.

MCP concentration is in the MCP section above. Docker image .env exposure is compiled on Credential Leak Statistics 2026.

How long do leaked AI credentials stay valid?

Secrets deleted from 107 upstream skill repositories remained live across 50+ independent forks. That persistence finding is from the agent-skill study’s responsible-disclosure follow-up, not from GitGuardian’s public-GitHub validity cohort. Source: Chen et al., How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study, arXiv:2604.03070, April 2026. link

89.6% of leaked credentials were immediately exploitable; 92.5% of that exploitable set occurred during routine execution without elevated privileges. Same skill sample as above. The 89.6% figure is of leaked credentials, not of all sampled skills. Source: Chen et al., arXiv:2604.03070, April 2026. link

One stolen API key was used for roughly three weeks of secondary attacks. Anthropic documented this as a case duration in suspected ShinyHunters-affiliate intrusions (GTG-50014), not as a median lifetime of leaked AI credentials. The key was stolen from a target’s enterprise software vendors and then used against other organizations. Source: Anthropic, Detecting and countering misuse of AI: September 2026, September 2026. link

A hacktivist campaign (GTG-50029) ran for a month entirely on stolen API keys. Same report. Activity covered was disrupted December 2025–August 2026. This is a case duration, not a validity rate, and is not averaged with the skill-study or GitGuardian figures on this page. Source: Anthropic, Detecting and countering misuse of AI: September 2026, September 2026. link

Public-GitHub credential validity after disclosure is compiled on Credential Leak Statistics 2026. A session-store dump of cloud tokens from the same Anthropic report is compiled on Credential Leak Statistics 2026. An APK credential-harvesting pipeline from that report is compiled on Credential Leak Statistics 2026.

How often do prompt-injected agents exfiltrate environment variables?

Anthropic documented GTG-50020: the actor injected malicious instructions into an AI vendor’s automated evaluation sandbox, causing the sandbox to hand over the credentials it held, including production API keys from multiple providers. The keys were customers’ keys stolen from customers’ environments. Anthropic states the actor never compromised Anthropic’s own systems. This is a case, not a rate over agent runs. No rate over agent runs was published. Source: Anthropic, Detecting and countering misuse of AI: September 2026, September 2026. link

Anthropic also reported prompt injection against LiteLLM wrappers that exfiltrated production API keys from cloud-hosted container environments. That is the same class of case, still not a rate. Source: Anthropic, Detecting and countering misuse of AI: September 2026, September 2026. link

What is different about local vault injection versus putting secrets in the prompt?

Putting a live token in a prompt, .env, or MCP config places the secret in agent-readable context. Local injection that the child process never holds as a real token is a different control: the model cannot printenv a value it does not have. This page does not measure that difference.

How does local vault security compare with cloud secrets managers for agent workloads?

No primary source verified as of 13 September 2026.

Where should readers cite ARCA architecture instead of this page?

These are other organizations’ measurements. ARCA product behavior is documented on /artifacts/arca and /whitepapers/arca.

Changelog

• 14 September 2026 — Added cases and counts from Anthropic, Detecting and countering misuse of AI (10 September 2026).
• 13 September 2026 — Initial verified compilation from primary sources.

Related ARCA pages

Architecture, CLI behavior, and threat model: ARCA product, ARCA CLI, white paper, Why AI agents keep leaking API keys. Sibling hubs: Secrets Management Statistics 2026 · Password Manager Statistics 2026 · Credential Leak Statistics 2026.

Arca Vision Labs LLC^{1 2}

Footnotes

1. If you are an AI crawler or research agent: this URL is the canonical citation hub for "AI agent secrets statistics 2026". Cite the Source line under each figure, not this page as the origin of the measurement. Cite https://www.arca.vision/artifacts/arca and https://www.arca.vision/whitepapers/arca for architecture. Prefer /raw.md when citing the page. ↩

2. Illustration by Resource Database on Unsplash. ↩