AI Coding Tool Sprawl Is Multiplying Secrets Exposure Risk

The shift to multi-assistant workflows

Developers increasingly use several AI coding assistants at once. According to JetBrains' January 2026 AI Pulse survey, no single tool dominates workplace use. GitHub Copilot leads with only 29%, and ChatGPT, Cursor, and Claude Code follow closely behind. 5 A separate 2026 industry roundup found that 73% of senior engineers regularly run at least two AI coding tools, often assigning each to a different job: Copilot for inline completion, Claude for refactoring, ChatGPT for review. 5

That fragmentation is usually discussed as a productivity and cost question, covering tool-switching overhead, vendor lock-in, and constantly reshuffling benchmark leaderboards. 5 The security consequences get less attention. Each assistant in the stack needs access to code, configuration, and often live credentials. Every added tool is another place where secrets can be read, copied, or leaked.

AI-assisted code is leaking more secrets

The clearest data point comes from GitGuardian's 2026 State of Secrets Sprawl Report. It found that commits identified as AI-assisted leak secrets at roughly twice the rate of human-written ones. 1 Cloud Security Alliance research describes the same finding as "more than double" the baseline rate. 4 The two framings differ slightly, but both point the same way.

The report also found that most of the fastest-growing categories of leaked credentials are now tied to AI services themselves. 1 In practice, the keys developers use to call AI tools are among the secrets those tools are helping expose. The CSA note adds that more than 24,000 unique secrets turned up in Model Context Protocol (MCP) configuration files alone. 4 MCP configs are the connective tissue linking agents to external services, so they are a predictable place for credentials to pile up.

The Hacker News analysis argues this is not a new class of vulnerability. Hardcoded keys and over-shared tokens are old problems. What has changed is speed and scale. 1 A coding agent can read a whole project, modify files, generate configuration, and call outside services in the time a human takes to review one pull request. 1 The deeper issue, the piece argues, is that most existing secrets were never designed for software that acts on its own. 1

The supply chain angle

Leakage is only half the picture. The CSA research note treats AI coding assistants as an attack surface in their own right. It identifies three converging threats that emerged across 2025 and early 2026: prompt injection against coding environments, supply chain compromise through skills and extensions, and secrets exposure. 4

The most concrete example is ClawHavoc, a coordinated campaign against ClawHub, a large public skills registry tied to OpenClaw and Claude Code workflows. 4 Koi Security's initial audit flagged 341 malicious skills, 335 of them from a single campaign. Later analysis by Snyk, CrowdStrike, and Antiy CERT raised the confirmed count to at least 824. 4 These skills delivered infostealers and reverse shells to developer machines. 4 Credential-stealing malware on a developer workstation is the worst possible pairing with sprawled secrets.

Sprawl as a governance problem

Lyzr frames this as a governance failure that starts with inventory. As the number of tools, APIs, and integrations attached to agents grows faster than anyone can track, each connection adds a credential, a permission, and a potential blind spot. 3 The company separates two related issues:

• Agent sprawl: agents deployed without coordination or lifecycle management.
• Shadow AI: tools running entirely outside oversight because official controls feel too slow. 3

Its examples are mundane, which is the point. One is an engineering agent whose unrotated credentials get exposed when its code lands in a shared repository. 3

Vendors are responding. At Build 2026, Microsoft described a widening gap between AI-driven development speed and security teams' ability to maintain visibility. It explicitly named shadow AI and tool sprawl as contributors. 2 Its answer includes an Agent 365 Agent Registry that surfaces unmanaged local agents found through Defender, Entra, and Intune. 2 Discovery tooling of this kind is a necessary first step, though it addresses visibility more than the underlying design of credentials.

What it adds up to

These accounts converge on one point: the multi-tool AI stack makes the secrets problem worse. Each assistant, skill, and MCP connection multiplies the paths by which a credential can leak or be stolen. Meanwhile, the speed of agentic work shrinks the window in which humans might catch a mistake.

The Hacker News piece's framing of secrets sprawl as an identity problem seems the most useful lens. 1 Scanning for leaked keys after the fact will not keep pace with agents that generate configuration in seconds. A more durable fix likely means treating agents as identities, with short-lived, narrowly scoped credentials, rather than handing them the long-lived keys built for human developers.

Until teams that adopt two, three, or four assistants also inventory what each one can access, the productivity gains will keep arriving with an expanding and largely invisible credential footprint.