Wiz Finds AI Secrets Commonly Exposed in Public Code Repositories
Summary
Wiz reports that a month-long scan found hundreds of validated secrets in public repositories, with AI-related secrets prominent. Common exposure patterns included notebooks and AI configuration files; the company recommends scanning and safer development practices.
Key points
- Wiz says it scanned thousands of public repositories and found hundreds of validated secrets, many still active.
- Three of the five most common validated secret types, and half of the top ten, were tied to AI, although the researchers did not intentionally target AI-related repositories.
- Jupyter notebooks were the most leak-prone file type; secrets appeared in code, printed outputs, diagnostics, and error messages.
- Hardcoded credentials in mcp.json and other AI-agent configuration files were another exposure pattern.
- Wiz found valid secrets associated with more than 30 companies and startups; one secret reported to MSRC was assigned Critical severity and could have exposed sensitive HR data.
- The researchers say popular scanning tools miss some AI-provider secret types, including credentials for Chinese AI platforms.
- Wiz recommends pre-commit hooks, periodic scans, CI/CD and Git-history scanning, and reviewing policies for notebook outputs and AI configuration files.
Article Details
- Publisher
- Wiz Research
- Report Period
- Month-long scan; dates not disclosed
- Scope
- Validated secrets in public code repositories, with emphasis on AI-related secrets and leakage patterns.
- Sample Size
- Thousands of repositories scanned; hundreds of validated secrets found.
- Key Statistics
- 4 of the top 5 secrets found were AI-related.
- About 40% of discovered secrets were assessed as potentially having a real impact on companies.
- 56% of detected secrets with company impact were found in employees’ personal repositories rather than company organizations.
- Exposed secrets were found in around 20% of the organizations checked; the authors said the study was not systematic.
- Valid secrets were found belonging to over 30 companies and startups, including multiple Fortune 100 companies.
- Recommendations
- Use secret-scanning pre-commit hooks, periodic scans, CI/CD pipeline integration, and Git history scanning.
- Review how notebooks are used and consider policies preventing check-in of notebooks with execution output.
- Ensure secret scanners cover non-renderable or large notebook files.
- Update scanning and detection flows for emerging AI secret types and usage patterns, and inspect how those secrets are used.
Vendors
AnthropicTaskmaster AI is another example of a broadly popular server (over 11k stars) that makes this unsafe recommendation – impacting customer secrets for AI providers like OpenAI and Anthropic: GitHubsecrets are a major attack vector in many widely known supply-chain attacks (i.e. codecov incident). GitHub, being the most popular code hosting platform (our State of Code Security Report puts the share ofHuggingFaceModel escape vulnerabilities in hosting services (Replicate, HuggingFace and SAP-AI vulnerabilities) OpenAITaskmaster AI is another example of a broadly popular server (over 11k stars) that makes this unsafe recommendation – impacting customer secrets for AI providers like OpenAI and Anthropic: PerplexityUnfortunately, many MCP servers favor configuration through hardcoded credentials within the mcp.json configuration file. Take, for example, the instructions for an unofficial Perplexity MCP server.WeightsAndBiasesipynb HuggingFace AzureOpenAI WeightsAndBiasesWizWiz Code includes a secrets scanner, offering customers protection. Wiz Research supports the product through ongoing investigations of public repositories and emergent patterns in secrets leakage. Unlike the State of
Products
JupyterLabis because they pack a unique combination of code, code output, and descriptive elements. According to JupyterLab docs, a notebook is a “shareable document that combines computer code, plain language descriptions,Model Context Protocolis known to favor hardcoding secrets. This forms a toxic combination with the emergence of Model Context Protocol servers. MCP is a rapidly developing technology, with thousands of servers launched in the monthsWiz CodeWiz Code includes a secrets scanner, offering customers protection. Wiz Research supports the product through ongoing investigations of public repositories and emergent patterns in secrets leakage. Unlike the State ofWizCloudAs part of the WizCode and WizCloud, our secret scanning module now detects the vast majority of the above secret types. In addition, the work is underway to add the rest under an AI-based classification.