by Shane Barney, Chief Information Security Officer (CISO), Keeper Security
A new study by Wiz has revealed that nearly two-thirds of leading private AI companies have leaked sensitive information such as API keys, tokens, and credentials on GitHub. The research suggested that rapid innovation in AI is outpacing basic cybersecurity practices. Among the most commonly leaked credentials were API keys from ElevenLabs and HuggingFace, some of the most used AI tools today, and these leaks may allow threat actors access to private training data or organizational information.
“The Wiz report highlights the growing challenge of managing machine-based credentials at scale. The discovery of exposed API keys, tokens and other programmatic secrets across leading AI companies shows how quickly machine-to-machine connections can expand as development and automation accelerate. Each of these credentials represents an access pathway that, if left unsecured, can expose sensitive systems or data.
As organizations adopt AI and cloud-native development, the number of non-human accounts and automated processes continues to rise. These machine identities are critical to modern operations, yet they often exist outside traditional identity and access management frameworks. When visibility into those credentials is limited, risk spreads quietly across systems that are otherwise well protected.
Reducing that risk requires sustained visibility and control, as well as a centralized enterprise-level approach to managing secrets. Continuous monitoring for exposed secrets, automated credential rotation and least-privilege access policies help contain exposure without slowing innovation. Treating machine-based credentials with the same rigor applied to human users strengthens both resilience and operational trust.
Implementing Privileged Access Management (PAM) in conjunction with secrets management extends that visibility and control even further. PAM enforces strict access boundaries and accountability for elevated permissions, while secrets management ensures that credentials used by systems and applications are securely stored, rotated and monitored. Together, these controls create a unified framework for managing both human and non-human identities, reducing credential sprawl and limiting the potential impact of an exposure.
The Wiz findings serve as a reminder that as technology grows more intelligent and interconnected, security must keep equal pace. The fundamentals still apply: know what identities exist, understand what they can access and ensure those privileges are tightly governed.”
