AI Code Assistants and Leaked Secrets: What the Data Says
GitGuardian's State of Secrets Sprawl 2025 report compared public repositories with GitHub Copilot enabled against public repositories overall, and found the Copilot repositories leaked secrets noticeably more often. This article looks at why AI-assisted coding raises the risk and what development teams can do about it.
The GitGuardian data
In its State of Secrets Sprawl 2025 report, GitGuardian found that public repositories with GitHub Copilot enabled had a secret incidence rate of about 6.4%, against about 4.6% across all public repositories: roughly 40% higher.
Source: GitGuardian, The State of Secrets Sprawl 2025. Correlation, not causation: teams that adopt AI tools may also differ in other ways.
Why AI tools increase leak rates
The mechanisms are multiple and interact with each other:
Higher commit velocity
AI-assisted developers push code faster. More commits per day means more opportunities for a bad commit to slip through review.
Reduced friction in the accept loop
When accepting an AI suggestion, developers typically review for correctness, not security. A suggestion that correctly implements a function but happens to reference a real env var gets accepted.
Context leakage
AI tools build context from open editor windows. A .env file in a split pane may inform suggestions that then embed key material in generated code.
Example patterns that look real
AI tools trained on codebases with hardcoded examples sometimes suggest inline key patterns that look like examples but are real format matches that tools detect as valid.
The context window problem
Modern AI coding assistants use large context windows that can include dozens of open files. A typical developer workflow might have:
- ▸app.ts open in the main editor
- ▸.env.local open in a second tab for reference
- ▸An integration test file open in a third tab
The AI assistant sees all three files. When it generates code in app.ts that uses an OpenAI client, it may complete the initialization with the actual key value from the open .env.local file, rather than the environment variable reference.
This is particularly likely when the AI is completing test code or example snippets where hardcoded values are common in training data.
More code, more exposure
One plausible driver is volume: AI assistance makes it easy to produce and push more code, and every commit is another chance for a credential to slip through. Another is the accept loop: suggestions get reviewed for “does it work”, not “does it embed a secret”.
This suggests that the most effective mitigation for AI-assisted development is pre-commit scanning - catching the occasional mistake before it leaves the machine - combined with making an accidentally committed credential worth as little as possible.
When AI suggests real-looking keys
A less common but more insidious pattern is when an AI tool suggests a string that matches a real secret format - for example, a placeholder string that happens to be in the sk-proj- format that OpenAI uses. A developer who accepts this suggestion without inspection may commit a string that pattern scanners flag as a real key.
This creates a different kind of problem: false alarms in secret scanning pipelines that erode trust in the tooling, leading to alert fatigue and legitimate warnings being ignored.
Example of a problematic AI suggestion
// AI completes your OpenAI initialization with a "placeholder" that
// matches the real key format and gets flagged by scanners:
const openai = new OpenAI({
apiKey: "sk-proj-exAmPlEkEy123456789abcdefghijklmnopqr",
// ↑ AI generated this from training context - not a real key,
// but scanners treat it as one
});What actually mitigates the risk
The answer is not to stop using AI tools - the productivity gains are real. The answer is to combine controls that work with high-velocity AI-assisted workflows:
Pre-commit scanning
Gitleaks or detect-secrets as a pre-commit hook catches the mistake before it leaves your machine. Essential for high-velocity workflows.
Closed context windows
Don't keep .env files open in your editor when using AI assistants. Configure your AI tool to exclude credential files from context.
Host-bound tokens in .env
If the value in your .env is a sanitized token rather than a real key, an AI that copies it into code has leaked something that only works from the origins you allowed.
Code review for AI-assisted commits
Require pull-request review for AI-assisted changes, with secrets explicitly on the reviewer's checklist. Pairs well with pre-commit scanning.
Use AI tools safely - with host-bound tokens
When your .env contains a sanitized token, an AI that copies it into a commit has leaked something the proxy refuses from origins you haven't allowed. Rotate it anyway.