September 2026 Summaries

Long-lived credentials such as API keys, tokens, and certificates combine authentication with standing authorization, creating risk when they are exposed because anyone holding them may inherit their permissions. The text argues that organizations are shifting toward workload identity, short-lived credentials, and runtime policy systems that separate identity verification from authorization decisions, particularly as AI agents can execute sequences of individually permissible actions with harmful combined effects. Introduced in August 2026, AWS Dogwood builds on the Cedar policy language by adding temporal policies that assess an agent’s current request alongside its recent tool-use history, enabling controls such as requiring recent human approval, limiting calls, tracking transaction totals, or blocking external actions after sensitive-data access. Dogwood is presented as complementary to standards and technologies including OAuth, OpenID Connect, SPIFFE/SPIRE, and AuthZEN, which support delegated access, machine identity, and standardized authorization interfaces. The text also emphasizes that modern authorization does not remove the need to manage legacy secrets, citing GitGuardian data showing 28.65 million hardcoded secrets added to public GitHub commits in 2025 and an 81% increase in AI-related credential leaks, while describing GitGuardian’s Secret Analyzer and Exploration Map as tools for assessing credential permissions, dependencies, and blast radius before replacing long-lived access.

GitGuardian reports that leaked secrets associated with AI services rose to more than 1.27 million in 2025, an 81% annual increase, with AI-assisted code exposing credentials at roughly twice the general GitHub rate. The post argues that prompts, tool calls, and agent workflows form an under-monitored channel because developers and automated agents may send commands, environment files, configuration data, or full files directly to third-party model providers without creating a repository artifact that can later be scanned. It recommends combining developer-side AI Hooks, which can block secrets close to their origin, with centrally managed AI gateways or LLM proxies that inspect all traffic crossing to providers, including shadow AI and automated workloads. Through GitGuardian’s Bring Your Own Source Custom Source integration, a gateway can submit payloads for in-memory scanning by more than 600 detectors, generate dashboard incidents without storing content, and either allow requests while recording findings or block them before reaching the provider. The suggested deployment approach is to begin in non-blocking mode for about two weeks to measure exposure and validate findings, then enable blocking, while recognizing that routing all model traffic through a gateway requires broader network and endpoint enforcement and provides coverage rather than complete containment.

AI coding tools such as Cursor, Claude Code, and GitHub Copilot can leave credentials in project and user-level configuration files, environment variables, logs, shell histories, session stores, temporary files, and plaintext fallbacks that repository and CI secret scanners generally do not inspect. While these tools support safer mechanisms including OAuth, OS keychains, and environment-variable references, inline tokens and copied secrets remain possible, particularly in MCP configurations that connect agents to source control, cloud services, databases, and internal systems. GitGuardian reports finding 24,008 unique secrets in public MCP-related configuration files, including 2,117 valid credentials, and observed a 3.2% secret-leak rate in public Claude Code-assisted commits compared with a 1.5% overall baseline, though this does not establish causation. The risk expands in large organizations as decentralized teams, contractors, varying endpoint policies, and rapidly adopted AI integrations create credential copies beyond the reach of identity systems, vaults, repository scans, and standard CI controls. GitGuardian Developer Endpoint Protection is presented as a complementary endpoint-focused approach that inventories AI agents and MCP servers, scans local files and storage locations, applies real-time AI-tool hooks, and deploys honeytokens, while keeping secret detection local and transmitting fingerprints and finding metadata rather than plaintext credentials.

GitGuardian and Docker have introduced a Sandbox Mixin Kit that combines Docker’s isolated microVM environments for AI coding agents with GitGuardian’s ggshield secret-scanning hooks. Docker Sandboxes limit an agent’s access to local files, networks, and credentials, addressing the risk that developer machines commonly contain numerous exposed secrets in configuration files, histories, caches, and AI tool directories. The mixin automatically installs ggshield and configures hooks for Claude Code, Cursor, Codex, and GitHub Copilot to scan prompts before they reach models, agent actions before execution, and tool outputs after they are returned. Detected secrets can block prompts or actions or notify developers of exposure, while Docker credential handling keeps API keys outside the sandbox until authorized use. The partnership aims to make protected agent workflows easy to adopt through preconfigured, repeatable environments, though ggshield’s AI hooks can also be installed directly without Docker Sandboxes.

GitGuardian found that 474 of 4,802 publicly exposed RSA private keys associated with GitHub Apps still authenticated successfully, representing 440 distinct Apps and demonstrating that leaked keys can remain usable indefinitely because they do not expire automatically. GitHub Apps use these keys to sign JWTs and obtain installation tokens that can access organizations and repositories according to the App’s permissions, making a compromised key capable of exposing private code, modifying repositories, controlling workflows or runners, or administering an organization. Among the affected Apps, 72% had permissions to access repository contents, 207 could write content, and 44 had organization administration privileges, while most had only a single installation and appeared to support internal or forgotten tooling. Case studies involving an Actions-access App, BuildBuddy, the abandoned Crusher.dev project, and a CDC-related App illustrate how leaked keys can create long-lived supply-chain risks affecting both App owners and organizations that installed them. The findings emphasize the need to continuously scan repositories for secrets, promptly revoke or rotate exposed keys, and treat GitHub App private keys as sensitive machine credentials.

Software supply chain attacks analyzed from 2025 to 2026 increasingly focused on harvesting credentials rather than merely distributing malicious code, exploiting compromised packages, maintainer accounts, CI/CD workflows, and trusted automation to reach developer environments. Developer machines and CI/CD runners are especially valuable because they often contain concentrated access to repositories, cloud platforms, package registries, deployment systems, SSH keys, and other secrets. Automated dependency updates and build processes can rapidly spread poisoned releases before detection, as illustrated by an npm Axios incident that affected hundreds of repositories shortly after release. Effective incident response therefore requires not only locating and removing compromised software but also identifying exposed identities, assessing their permissions, monitoring potential misuse, and revoking or rotating affected credentials. The discussion highlights findings from Shai-Hulud 2.0, in which thousands of valid secrets were identified among more than 33,000 unique secrets exfiltrated, and emphasizes that organizations benefit from maintaining an inventory of secrets and non-human identities before an incident occurs.

AI autonomy describes how independently an agent can pursue goals, and the Cloud Security Alliance’s Level 0–5 framework provides terminology ranging from human-executed tasks to full autonomy, with Level 3 marking agents that act independently within defined boundaries. The discussion argues that an agent’s effective autonomy depends not only on prompts and policies but also on the credentials and systems it can access, since overly broad, inherited, exposed, or long-lived credentials can let an agent exceed intended limits. Credential risks increase through an agent’s reach across systems, frequency of automated actions, reduced human review of intermediate steps, and persistence of secrets after temporary tasks end. Existing secrets sprawl, growing AI-service credentials, developer endpoint data, and expanding integrations such as MCP servers can further enlarge agent access without creating a distinct agent identity. Organizations are encouraged to continuously compare intended autonomy with actual credential-based authority by inventorying agents and accessible credentials, prioritizing and remediating excessive access through revocation, rotation, scoping, or secure storage, and preventing new secret exposure with endpoint monitoring and safeguards in AI coding tools.

Service-account credentials often remain active despite leaks, age, or unclear ownership because teams fear disrupting undocumented production dependencies. Effective rotation requires assessing eight areas: whether the credential remains valid or has leaked, its permissions, all consuming systems, vault location, duplicate copies, accountable owner, and a tested rollback plan. Because machine identities and their secrets are widely distributed across code, pipelines, vaults, scripts, and infrastructure, credential rotation should be treated as a controlled production change, preferably using staged replacement credentials and managed secret stores. The piece presents GitGuardian’s Exploration Map as a tool for connecting credentials to associated incidents, permissions, resources, consumers, storage locations, and owners, helping teams evaluate both security and operational blast radius before revoking access. It also advocates reducing reliance on long-lived static secrets through managed vaults, dynamic or short-lived credentials, and federated workload identities where possible.

AI-driven development has expanded the public exposure of credentials, with GitGuardian reporting 1.27 million AI-service credentials exposed in public code in the previous year, an 81% increase, and noting that 64% of secrets verified as valid in 2022 remained unrevoked in January 2026. To address the growing burden of reviewing public leaks, GitGuardian has introduced an AI-agent analysis capability for its Public Secrets Monitoring product that examines incidents on GitHub and Docker Hub to determine whether a secret is related to a customer organization, assign a contextual risk score, and provide visible reasoning. The system uses a triage agent followed by deeper analysis for promising cases, classifying incidents as Related, Uncertain, or Unrelated, while keeping remediation decisions and incident closure under human control. The beta feature is enabled by default for new workspaces and is being gradually introduced to existing customers, with analysis generally available within a day of detection. GitGuardian argues that combining public monitoring with explainable automated triage can reduce alert noise, speed investigations, and help teams focus on revoking credentials, identifying their internal source, and addressing broader exposure.

CI/CD systems are increasingly targeted because they connect developer code to repositories, build tools, package registries, cloud infrastructure, secrets, and production deployments, with recent self-propagating supply-chain campaigns such as Shai-Hulud, Miasma, and ChainDrop demonstrating the scale of the threat. The OWASP Top 10 CI/CD Security Risks identifies failures involving flow controls, identity management, dependencies, pipeline execution, permissions, credentials, configurations, third-party services, artifact integrity, and visibility, all of which can enable attackers to exploit trusted delivery paths. The text argues that insufficient credential hygiene is a central risk because exposed, long-lived, or overly privileged tokens can transform an initial compromise into lateral movement, persistence, data access, or deployment authority. It presents GitGuardian’s credential-security approach as combining secret detection across repositories, containers, pipelines, developer endpoints, and AI-assisted workflows with integrations for secrets managers, CI systems, cloud IAM, and non-human identity governance. Recommended practices include detecting leaked credentials early, limiting permissions and credential scope, favoring temporary access, validating and prioritizing findings, and rotating or revoking risky secrets to reduce the blast radius of CI/CD attacks without impeding automation.

Endpoint protection traditionally refers to antivirus, EDR, and XDR tools that continuously monitor processes, memory, files, and network activity to detect and contain malware, ransomware, lateral movement, and credential-theft behavior. The text argues that these behavioral controls do not generally inventory valid plaintext credentials—such as cloud keys, API tokens, and SSH keys—stored in developer files, shell histories, caches, environment variables, or AI-tool directories, creating a separate need for credential discovery. Credential security uses scheduled scans to identify exposed secrets, assess their severity and validity, and support remediation through revocation, rotation, redaction, or monitoring with decoy credentials known as honeytokens. It emphasizes that stolen credentials and session tokens may enable apparently legitimate access that behavioral tools cannot reliably distinguish from authorized activity, particularly when identity controls are incomplete. Citing GitGuardian data, it states that developer laptops average 150 secrets and that private keys account for 38% of them, while many high-risk findings occur outside repositories in logs and AI-tool locations. During an incident, preexisting credential inventories can help teams determine what credentials may have been compromised and prioritize rotation alongside EDR evidence about attacker behavior. The piece presents GitGuardian Developer Endpoint Protection as a complementary credential-security product rather than a replacement for EDR, advocating a combined endpoint strategy that covers both malicious activity and exposed secrets.