Exposed credentials up 81% to 1.27 million; GitGuardian adds AI agents for triage

GitGuardian reports that credentials exposed in public code reached 1.27 million last year, an 81% increase, and it attributes the surge largely to AI-driven development. Its response to the resulting workload is to deploy AI of its own: the company's Public Secrets Monitoring product now runs two AI agents over every public incident detected on GitHub and Docker Hub, each producing a verdict on whether a leak concerns a given organization, a risk score, and the reasoning behind both.

The exposure is growing and sticking

According to GitGuardian, AI-assisted development has spread secrets well beyond source repositories and CI/CD pipelines. Credentials now turn up in MCP configuration files, AI tool caches, terminal session logs, and code produced by coding agents. The company counted 24,008 unique secrets in publicly visible MCP configuration files alone.

The lifetime of a leak compounds the volume. When GitGuardian retested secrets it had confirmed valid in 2022, 64% were still unrevoked as of January 2026, meaning those credentials continued to grant access to the same systems years after first exposure.

GitGuardian's framing is that detection at this scale is not the hard part; the bottleneck sits downstream of the alert. Reviewers need to know whether a leaked key actually belongs to their organization, and whether it demands action today.

The two decisions that gate every incident

GitGuardian identifies ownership and severity as the questions that determine whether a monitoring program delivers value or drowns in noise. Ownership is genuinely ambiguous in both directions: a cloud key in an employee's personal repository may belong entirely to that employee's own account, while a key committed by an unknown outsider may matter because nearby code references one of the company's internal services.

Severity is equally contextual. A live production database password in a public commit months old demands a different response than a sandbox test key, and a bare numeric score flattens that difference without explaining what should happen next. Review everything and analysts waste hours on incidents that were never theirs; review too selectively and genuine leaks slip past. Neither stance holds up as volume grows.

A two-agent pipeline

The updated product runs a triage agent over each public incident for an initial assessment, then passes the most consequential cases to a second, deep-analysis agent for fuller investigation. Results surface in three places.

Every incident receives a verdict of Related, Uncertain, or Unrelated, with reasoning that can be inspected rather than a probability to interpret. Only the deep-analysis agent can confirm a Related verdict, so that label implies both passes were cleared.

An agent-computed risk score accounts for the type of credential, where it surfaced, and the systems it can access. It is assigned once and stays fixed, and anything marked Unrelated scores zero, so ranking incidents by risk pushes noise toward the bottom of the queue.

A new Analysis tab lays out how the agents reached their conclusion, including the triage reasoning, the deeper investigation where it ran, and a timeline of both. GitGuardian contrasts this with tooling that returns a classification and asks to be trusted; a reviewer who disagrees can see which signals drove the verdict and weigh their own knowledge of the environment against them.

The product also ships with three pre-built saved views covering company-related, unclear, and unrelated incidents, plus a feedback loop that lets reviewers flag verdicts that miss so GitGuardian can improve later analysis versions.

Rollout, limits and early results

New Public Secrets Monitoring workspaces get Agents Analysis enabled by default, with the verdicts, scores, Analysis tab and saved views available immediately. Existing workspaces migrate gradually, since many teams have workflows built around the previous tags and scoring. The capability is in beta, with analysis arriving within a day of detection rather than in real time; customers wanting earlier access can request it through their Customer Success Manager.

GitGuardian says one enterprise security team managing incidents through an MCP server integration reported a 10x productivity gain, with the verdict, reasoning and risk score replacing the manual research that previously preceded each remediation conversation. The platform still closes nothing automatically; human review remains the final step on every incident.

Why it matters

The figures come from a vendor describing its own product, so the scale claims should be read in that light. Even so, the pattern is concrete: AI coding tools have expanded the surfaces where secrets leak, and the backlog is measurable, with nearly two-thirds of secrets confirmed valid in 2022 still live more than three years later. GitGuardian also notes that secrets spotted in public have typically already leaked internally, making the public alert the earliest external symptom of an upstream failure rather than the start of the story. If leaks now appear at machine pace, triage done purely by hand stops scaling, and this is a case of the same class of tooling being pointed at a problem it helped create. The design choice worth watching is the insistence on visible reasoning and human sign-off: automation narrows the queue, but the judgment to rotate a credential still sits with the team.