With rapid AI innovation outpacing basic cybersecurity practices, non-human agents and automated processes are creating machine identities at scale, leading to inadvertent leakage of API keys, tokens and credentials.
A new study by Wiz has revealed that nearly two-thirds of leading private AI companies have leaked sensitive information such as API keys, tokens, and credentials on GitHub.
The research suggested that rapid innovation in AI is outpacing basic cybersecurity practices. Among the most commonly leaked credentials were API keys from ElevenLabs and HuggingFace, some of the most used AI tools today, and these leaks may allow threat actors access to private training data or organizational information.
According to Shane Barney, CISO, Keeper Security, the Wiz report highlights the growing challenge of managing machine-based credentials at scale, and demonstrates why visibility and control are important.
“The discovery of exposed API keys, tokens and other programmatic secrets across leading AI companies shows how quickly machine-to-machine connections can expand as development and automation accelerate. Each of these credentials represents an access pathway that, if left unsecured, can expose sensitive systems or data,” he commented.
Machine identities, critical to today’s business operations, are growing at an exponential rate as organizations adopt AI and cloud-native development, and the number of non-human accounts and automated processes continues to rise. However, they often exist outside traditional identity and access management frameworks.
“When visibility into those credentials is limited, risk spreads quietly across systems that are otherwise well protected,” said Barney.
What to do
Barney advised: “Reducing that risk requires sustained visibility and control, as well as a centralized enterprise-level approach to managing secrets. Continuous monitoring for exposed secrets, automated credential rotation and least-privilege access policies help contain exposure without slowing innovation. Treating machine-based credentials with the same rigor applied to human users strengthens both resilience and operational trust.”
Additionally, he said: “Implementing Privileged Access Management (PAM) in conjunction with secrets management extends that visibility and control even further. PAM enforces strict access boundaries and accountability for elevated permissions, while secrets management ensures that credentials used by systems and applications are securely stored, rotated and monitored.”
Together, these controls create a unified framework for managing both human and non-human identities, reducing credential sprawl and limiting the potential impact of an exposure.
“The Wiz findings serve as a reminder that as technology grows more intelligent and interconnected, security must keep equal pace,” concluded Barney. “The fundamentals still apply: know what identities exist, understand what they can access and ensure those privileges are tightly governed.”
