One in Four Organizations Are Leaking Secrets Through AI Agent Config Files

A new report from Codacy, surfaced by Hacker News, found that a scan of 34,266 public and private repositories turned up exposed credentials, API keys, and system prompts in AI agent configuration files at one in four organizations. The failure rate would be alarming in any security audit; it is particularly dangerous when those agents have autonomous access to databases and production systems.

The pattern is familiar: rapid deployment outpaces security hygiene. Developers are treating agent configuration files the same way early engineers treated .env files a decade ago — as an implementation detail rather than an attack surface. The difference now is the blast radius. An agent with a leaked API key and database access is not just a data exposure; it is an autonomous actor that can be commandeered by an attacker.

Codacy did not publish a list of affected organizations, but a one-in-four rate across 34,266 repos is systemic, not an edge case. Any security team that has not audited its AI agent configurations should treat that as the highest-priority item on the backlog — before the next automated deployment.

Read the full story at Hacker News AI