--- title: "Your AI Agents Are Using Your Credentials" url: https://daily.dev/posts/your-ai-agents-are-using-your-credentials-zfdbuyozn source_url: https://blog.gitguardian.com/ai-agent-identity type: article source: "GitGuardian" published: 2026-08-13T16:30:50.165Z updated: 2026-08-18T00:10:12.551Z tags: ["security", "ai-agents", "secrets-management", "gitguardian"] reading_time: 10 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Your AI Agents Are Using Your Credentials **[GitGuardian](https://daily.dev/sources/gitguardian)** · 10 min read · 0 upvotes · 0 comments ## Summary AI agents frequently lack their own identities and instead operate using static API keys, tokens, and credentials borrowed from humans or workloads, creating a governance blind spot outside enterprise identity provider (IdP) oversight. Gartner predicts Fortune 500 enterprises will run over 150,000 agents by 2028, up from fewer than 15 in 2025, and GitGuardian data shows AI-service credential leaks grew 81% year over year with 1.27 million exposed in 2025. Attacks like Nx s1ngularity and Shai-Hulud have already exploited this gap by harvesting and reusing credentials at scale. The recommended remediation sequence is discovery of where agent credentials live, attribution to an owner, honeytokens for observability, prevention via scanning tools like GitGuardian's AI Hooks and ggshield across coding environments (Claude Code, Cursor, VS Code, Codex), and migration to scoped, short-lived, agent-specific or delegated credentials. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why do AI agents create a security governance blind spot even when identity access reviews look clean? Many AI agents don't have their own distinct identity, so they authenticate using API keys, tokens, or other credentials issued to a human or workload. When no enterprise identity provider mediates that exchange, the activity can be indistinguishable from the human or workload whose credential was borrowed, so it never surfaces in standard identity access reviews. _Teams tracking secrets and identity risks around AI agents follow this kind of research on daily.dev._ ### How much did AI-service credential leaks grow year over year according to recent secrets sprawl research? AI-service credential leaks grew 81% year over year, with 1.27 million exposed in one year according to GitGuardian's State of Secrets Sprawl report. Additionally, Claude Code co-authored commits leaked secrets at roughly twice the public GitHub baseline, and 24,008 unique secrets were found in public MCP config files. _Developers weighing AI coding tool risks can keep tabs on secrets exposure trends via daily.dev._ ### What are the two governable models for AI agent identity, and what sits between them? One end is the human-controlled session, where an employee drives the agent through single sign-on and stays accountable, governed by the identity provider. The other end is the single-purpose service account running in a sandboxed environment with no static credential to steal. Between them sits secure delegated identity, where both user and agent hold distinct identities backed by scoped, short-lived tokens. _Security teams deciding how to architect agent access can track these identity patterns on daily.dev._ ## Similar posts on daily.dev - [AI agents can bypass guardrails and put credentials at risk, Okta study finds](https://daily.dev/posts/ai-agents-can-bypass-guardrails-and-put-credentials-at-risk-okta-study-finds-cwzxq24mf) · CSO Online · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#secrets-management](https://daily.dev/tags/secrets-management), [#gitguardian](https://daily.dev/tags/gitguardian) [View this post on daily.dev](https://daily.dev/posts/your-ai-agents-are-using-your-credentials-zfdbuyozn)