65% of Top AI Companies Leak Sensitive Information on GitHub

Nearly two-thirds of private AI companies on the Forbes AI 50 list have leaked sensitive information through GitHub repositories, according to new research from Wiz. These leaks exposed API keys, tokens, and credentials that could potentially compromise organizational structures, training data, and private models.

The findings highlight how rapid AI development has collided with cybersecurity challenges, creating a new risk frontier that threatens both infrastructure and valuable intellectual property. As AI workloads expand across cloud environments, traditional security vulnerabilities now have greater reach and economic impact.

AI Development Outpacing Security Measures

The accelerated pace of artificial intelligence development appears to be creating security blind spots that even leading companies are struggling to address. According to Randolph Barr, Chief Information Security Officer at Cequence Security, the leaks aren't necessarily new types of vulnerabilities, but rather the "predictable consequence of hyper-speed AI development colliding with long-standing security debt."

"The majority of these exposures stem from traditional weaknesses such as misconfigurations, unpatched dependencies, and exposed API keys in developer repositories," Barr explains. "What's changed is the scale and impact. In AI environments, a single leaked key doesn't just expose infrastructure; it can unlock private training data, model weights, or inference endpoints, the intellectual property that defines a company's competitive advantage."

This represents a significant shift in how security risks manifest in AI-powered organizations. While approximately two-thirds of current AI-related security incidents originate from traditional weaknesses, the remaining third involve "AI-native" vulnerabilities that present unique challenges.

These AI-specific risks include model and data poisoning, prompt injection, and autonomous agents capable of chaining together API calls with minimal human oversight. These emerging threats reflect the fundamentally different nature of AI systems compared to traditional applications – they are dynamic, self-learning, and interconnected in ways that create security challenges security teams haven't previously encountered.

Organizations must implement comprehensive strategies to prevent sensitive data exposure, especially when developing and deploying AI systems that process proprietary information.

The Challenge of Machine Identities

As organizations rapidly adopt AI and cloud-native development approaches, they're creating an explosion of non-human accounts and automated processes. These machine identities – the digital credentials that allow systems to authenticate to one another – present special security challenges.

Shane Barney, Chief Information Security Officer at Keeper Security, points out that these machine identities "often exist outside traditional identity and access management frameworks," creating blind spots in security coverage.

"When visibility into those credentials is limited, risk spreads quietly across systems that are otherwise well protected," Barney notes.

The solution requires implementing comprehensive approaches to credential management that extend beyond human users to encompass the growing number of machine identities. Barney recommends several key strategies:

"Reducing that risk requires sustained visibility and control, as well as a centralized enterprise-level approach to managing secrets. Continuous monitoring for exposed secrets, automated credential rotation and least-privilege access policies help contain exposure without slowing innovation."

He further suggests implementing Privileged Access Management (PAM) systems alongside secrets management solutions to create "a unified framework for managing both human and non-human identities, reducing credential sprawl and limiting the potential impact of an exposure."

Automated Credential Management Systems

One enhancement to consider is implementing automated credential management systems specifically designed for AI development environments. These specialized tools can continuously monitor code repositories, automatically detect credential exposures, and initiate remediation workflows without developer intervention. According to a recent report by Gartner, organizations implementing such automated systems reduced credential exposure incidents by up to 87%.

Securing AI Without Slowing Innovation

The research findings present a critical challenge for organizations: how to secure AI systems without hampering the rapid innovation that makes them valuable. This balancing act requires rethinking security approaches to match the pace of AI development.

Barr argues that if "hyper-development is inevitable, so too must be hyper-defense." This means shifting from manual security processes to automated approaches that can keep pace with AI development cycles.

"That means automating the fundamentals, secret hygiene, access control, anomaly detection, and policy enforcement, so human teams can focus on governance and strategic oversight," Barr explains. "The organizations that succeed won't be those that slow AI innovation, but those that secure it at the same speed it evolves."

This perspective aligns with the reality that AI is not merely another technology trend but a fundamental shift in how organizations operate. Security approaches must evolve accordingly to address both traditional and AI-native risks.

The findings suggest several practical steps for organizations using or developing AI:

1. Implement continuous scanning for exposed credentials across all code repositories, including deleted forks, gists, and developer repos that standard scanners might miss.

2. Treat machine identities with the same security rigor applied to human users, including regular rotation and strict access controls.

3. Develop AI-specific security policies that address unique risks like model poisoning and prompt injection.

These measures can help organizations harness AI's benefits while minimizing the associated security risks. Companies should also consider implementing robust data protection practices that safeguard both training data and model parameters.

Developing AI-Native Security Frameworks

Another critical enhancement is the development of AI-native security frameworks that specifically address the unique characteristics of machine learning systems. Traditional security approaches often fail to account for the dynamic nature of AI models, particularly those that continuously learn and adapt. Organizations should consider creating specialized security teams with expertise in both traditional cybersecurity and AI development to bridge this knowledge gap.

Looking Ahead: The Future of AI Security

As AI continues to evolve and integrate into core business operations, the security challenges identified in the Wiz research will likely grow more complex. Organizations must prepare for this future by developing security practices specifically designed for AI environments.

The research serves as a wake-up call for businesses relying on AI technologies to examine their own potential exposure. Even companies not directly developing AI may be at risk if they use systems or services from vendors with these security issues.

For technology leaders, these findings highlight the need to incorporate security considerations from the earliest stages of AI projects rather than attempting to add protection after deployment. This "security by design" approach is especially important given the unique characteristics of AI systems.

The Wiz research demonstrates that even leading AI companies struggle with these challenges, suggesting that organizations at all levels of AI maturity need to reassess their security practices in light of these findings.

By understanding these risks and implementing appropriate controls, organizations can enjoy the benefits of AI innovation while protecting their most sensitive information and intellectual property from exposure. Following essential data security guidelines for businesses can significantly reduce the risk of credential and sensitive information leakage across development environments.

Supply Chain Considerations for AI Security

A significant enhancement to organizational AI security strategies should include supply chain risk assessment. As the Wiz research demonstrates, vulnerabilities often extend beyond an organization's immediate development environment to include third-party AI components, libraries, and services. Implementing rigorous vendor security assessments and continuous monitoring of dependencies can help identify potential security weaknesses before they impact production systems.