GitHub cracks down on AI-driven credential leaks with 28 new secret detectors

GitHub has strengthened its defences against leaked credentials with a major update to secret scanning. On March 10, 2026, the platform added 28 new detectors focused on AI and cloud service keys. The move comes as developers increasingly rely on AI-powered tools, raising concerns about accidental exposure of sensitive data.

The surge in leaked secrets is tied to modern coding habits, particularly 'vibe-driven development'. This approach—where AI-generated code is quickly pushed live—has doubled the risk of secret exposure. Code written with AI assistants like Claude Code leaks credentials at a rate of 3.2%, compared to 1.5% for human-written code.

GitHub now blocks uploads containing highly sensitive secrets, enforcing 'push protection' as a default. Despite this, over 8,000 OpenAI credentials were left publicly accessible in 2026. Criminal forums have also capitalised on the trend, circulating 6.2 million stolen AI tool credentials this year alone.

Stolen API keys enable 'AI jacking', where attackers run expensive queries on victims' accounts. One compromised account racked up $82,000 in charges within 48 hours. Security experts are now advocating for short-lived tokens that expire automatically, reducing the damage from leaks.

The issue extends to Model Context Protocol (MCP) files, which often store credentials. GitHub's scans found over 24,000 exposed secrets in these files. By late 2026, service accounts and API tokens are projected to outnumber human users in businesses by 50 to one.

GitHub's expanded scanning aims to curb the rising tide of credential leaks tied to AI development. With stolen keys fuelling costly attacks, the platform's stricter protections arrive as enterprises face an explosion of automated service accounts. The shift toward short-lived tokens may further limit the fallout from exposed secrets.