As enterprise AI adoption skyrockets, the proliferation of unauthenticated agents and reused credentials presents escalating security risks. Experts call for discovery, attribution, and scoped access to mitigate threats associated with secret sprawl.
The central problem with many enterprise AI agents is not identity governance alone, but secret sprawl. In practice, a large share of agents do not authenticate through a distinct, policy-managed identity. They borrow API keys, tokens and other credentials that were originally issued to people or workloads, then act with those permissions outside the visibility of standard identity reviews. That creates a blind spot: the target system sees a valid credential, but not whether it was exercised by a human, an automation or an AI agent. GitGuardian argues that the first step is therefore discovery and attribution, not a wholesale redesign of the identity stack.
That framing matters because the scale of the problem is changing quickly. Gartner has forecast that an average global Fortune 500 company could be using more than 150,000 agents by 2028, compared with fewer than 15 in 2025. GitGuardian said it found 24,008 unique secrets in public MCP configuration files in 2025 and 1.27 million exposed AI-service credentials that year, while more than 64% of credentials confirmed valid in 2022 were still valid when retested in January 2026. In other words, long-lived secrets remain easy to reuse, and an over-privileged agent can turn one leaked credential into broad access across a network.
The risk is especially acute at the edges of development, where agents are being adopted by citizen developers as well as software engineers. GitGuardian says secrets often end up in places security teams do not routinely inspect, including MCP server configuration files, environment files, shell history, logs and developer credential stores. In some cases, AI coding tools can even pull secrets from password managers at runtime and write them into caches or session logs. The result is familiar in form but faster in execution: a static credential is copied into an automation, and that automation begins operating as the credential’s owner in systems no one is watching closely enough.
That is why several security vendors are pushing the same broad direction even if they describe it differently. AuthSpoke says enterprises need a live directory of AI agents, governed identities, policy controls, audit trails and kill switches. DeepInspect argues for keeping keys at the gateway and issuing only short-lived, identity-bound tokens to the agent. TechRadar has similarly described the challenge as one of governance rather than raw capability, with a need to isolate, scope and approve agent actions at the infrastructure layer. The shared conclusion is that agents should not hold reusable secrets if they can be given narrow, revocable access instead.
GitGuardian’s answer is a staged approach. First, organisations need fleet-wide discovery to locate the credentials agents actually use. Next comes attribution, so each secret can be tied to a human or workload owner. Then teams can add honeytokens as tripwires while they clean up the backlog, and use controls that scan prompts, file reads and tool calls before an agent acts. The longer-term target is a brokered model in which an agent requests access at runtime and receives a scoped, short-lived credential it never stores. That would not solve every governance problem, but it would remove the most dangerous one: a reusable secret sitting on disk for an attacker, or an agent, to harvest.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
