Secrets in AI-Generated Code: How Coding Agents Leak Credentials | Blog | Endor Labs

What it is

An Endor Labs blog framing how AI coding agents multiply the classic hardcoded-credential problem (CWE-798). Its distinct, carry-worthy claim beyond the summary: an agent can leak one secret four ways in a single task, and only one leaves a trace in your repository — which reframes this as a scanning-coverage problem, not just a code-review problem.

How it works

Two root causes. (1) Training habit: models learned from public code that hardcoded secrets, optimize for code that runs over code that's secure, and reuse placeholder secrets that occasionally match a live key. (2) Whole-workspace ingestion: assistants read the full project — including .env and config files — to build context, then can paste a live token into new code even when .gitignore/.npmignore was meant to exclude it (Check Point: "regurgitating sensitive tokens into the production code").

The leak surface spans places default-branch scanners don't look: MCP configuration, git history, notebooks, and config files. The MCP layer is called out specifically — Endor's State of Dependency Management 2025 found 75% of MCP servers are built by individuals and 82% use sensitive APIs.

Preconditions / Affected

Any team using AI coding assistants with repo/workspace access, MCP servers, or developers pasting source into external GenAI tools. The exposure worsens where secret scanning covers only the default branch.

What to do

The page's one concrete operational takeaway: extend secret-scanning coverage beyond the default branch — include git history, notebooks, and config files (MCP configs, .claude/settings.local.json). It also warns that cleanup takes more than one step: rotating keys, purging commits, and force-pushing a clean history "doesn't guarantee your credential isn't still sitting somewhere it shouldn't," because a secret in git history stays in old commits. Treat rotation as the real remediation, not just history rewriting. For teams under FedRAMP or the EU CRA, the durable-history problem affects remediation-timeline compliance.

Caveats

This is a vendor problem-sizing post — no patches, commands, or tool-specific detections. Supporting metrics beyond the summary are cited from third parties, not Endor's own testing: GitGuardian's 28.65M new secrets in public GitHub commits in 2025 (+34% YoY) and 24,008 secrets in MCP-related configs; AI service secrets at 1,275,105 (+81% YoY); Wiz finding half its top-ten validated secrets tied to AI; and Verizon 2026 DBIR reporting source code as the most-submitted data type to external GenAI tools and shadow-AI data-loss events up ~400% YoY.