Non-human identities and artificial intelligence are transforming software development at an unprecedented pace. Teams are shipping applications faster, integrating dozens of cloud services in days instead of months, empowering developers—and increasingly non-developers—to build with AI.
There's a hidden cost to this acceleration: an explosion of machine credentials that organizations can’teffectively govern.
The latest State of Secrets Sprawl 2026 report from GitGuardian paints a sobering picture. In 2025, 28.65 million new hardcoded secrets were detected in public GitHub commits—a 34% year-over-year increase, the largest annual jump recorded.
The numbers are startling. But the underlying trend is even more important.
Every API integration, AI agent, CI/CD pipeline, database connection, and cloud workload requires authentication. AI-assisted development dramatically lowers the barrier to creating software, but it also dramatically increases the number of non-human identities (NHIs) organizations must manage.
GitGuardian found that eight of the ten fastest-growing categories of leaked secrets are tied to AI services, while credentials supporting AI infrastructure such as orchestration, vector databases, and retrieval systems are growing 5x faster than core LLM providers.
This isn't simply "more API keys." It's a new identity landscape. Every AI workflow introduces more credentials. Every credential becomes another asset that must be created, stored, rotated, monitored, and revoked.
Read more about managing non-human identities: Beyond Human Users: Why Non-Human Identities Are the Next Frontier in Cybersecurity
Public GitHub often receives the attention because it's visible.
According to the report, internal repositories are 6x more likely to contain hardcoded secrets than public repositories. More concerning, 28% of secret exposure incidents occur outside source code altogether—in Slack, Confluence, and other collaboration platforms. These incidents are actually more likely to be classified as critical.
This changes the conversation. Secrets are no longer just a software development issue. They're becoming an enterprise-wide governance challenge.
Perhaps the most alarming statistic in the report is 64% of secrets that were already leaked in 2022 remain valid today. Four years after exposure, organizations still haven't revoked or rotated them.
Finding secrets is important. Finding them without fixing them simply tells attackers which credentials might still work.
The report makes another observation: organizations relying only on validation to prioritize remediation are missing nearly 46% of their critical secrets, while 83% of high-risk secrets never get addressed.
The challenge isn't visibility anymore. It's governance.
Traditional secrets management assumes long-lived credentials stored safely inside vaults. That model helped solve password sprawl, but not identity sprawl.
As AI agents, autonomous workflows, ephemeral workloads, and cloud-native applications become the norm, organizations are creating thousands of machine identities that require dynamic, policy-based authentication.
Managing ever-growing inventories of static secrets becomes operationally impossible.
Instead of asking, "Where are my secrets?" Security leaders increasingly need to ask:
One of the encouraging conclusions in the report is its recommendation to move toward identity-driven authentication.
Rather than embedding long-lived credentials into applications, organizations should adopt cryptographically verifiable workload identities that can request short-lived credentials just in time. Frameworks such as SPIFFE and SPIRE are specifically designed for this model, replacing shared secrets with attested workload identities that are issued, verified, and automatically rotated.
This represents a fundamental architectural shift. Instead of protecting secrets forever, we reduce the need for secrets altogether.
Read the whitepaper: What AI Agents and Non-Human Identities mean for PAM | SSH
The rise of AI isn't just accelerating software development. It's accelerating the growth of NHIs. Organizations that continue treating secrets as isolated developer mistakes will find themselves fighting an increasingly unwinnable battle. The organizations that succeed will shift their focus from managing credentials to governing identities.
Secrets detection remains essential, but lasting security comes from ensuring that NHIs are continuously authenticated, authorized, and granted only the minimum access they need through short-lived, automatically managed credentials rather than static secrets scattered across repositories, pipelines, and collaboration tools.
Read why KuppingerCole named SSH a leader in all categories for Secrets Management >>>