Exposed AI credentials surge, leaving businesses vulnerable to cyberattacks

A sharp rise in exposed AI and cloud credentials is putting businesses at risk. Security experts warn that automated systems and API tokens will soon far outnumber human users in enterprises. By the end of 2026, these non-human accounts could exceed human ones by 50 times.

The problem is growing as AI-powered coding tools and careless development practices leave sensitive data vulnerable. Recent scans reveal thousands of leaked secrets, with criminals actively trading stolen credentials online.

A study found that AI coding assistants leak secrets at a rate of 3.2%, more than twice as often as human-written code. This trend, combined with 'vibe-driven coding'—where developers prioritise speed over security—has led to widespread exposure of critical data. GitHub recently reported over 24,000 exposed secrets in files linked to the Model Context Protocol (MCP). Another scan uncovered 8,000 unique OpenAI credentials accessible to anyone with a web browser.

Criminal forums now circulate over 6.2 million stolen AI tool credentials. The financial risks are severe: one 'AI jacking' incident resulted in $82,000 in unauthorised charges within just 48 hours. GitHub has responded by expanding its secret scanning to cover 28 new AI and cloud platform detectors. It also blocks code uploads if highly sensitive secrets are detected under its push protection standard.

Industry leaders are calling for a shift in DevSecOps practices. They want secret scanning embedded directly into AI chat interfaces and development tools. The goal is to catch vulnerabilities before they reach public repositories or production environments.

The surge in exposed AI credentials highlights gaps in current security measures. Companies must adapt as non-human accounts dominate enterprise systems. Without stricter controls and better integration of security tools, the financial and operational risks will continue to grow.