The pace of code creation is outstripping the ability of developers to manually protect it. Automation that speeds up development must be matched by automation that secures it.
GitHub's data shows a sharp rise in AI involvement in the development workflow. One in three pull requests now involves an AI agent, up from fewer than one in 10 a year ago. If this trajectory continues, most code arriving on GitHub within two years could originate from an agent, with much of it never reviewed by human eyes.
The responsibility falls on the platform to ensure that protective measures keep pace with this acceleration. This means catching credential leaks before they become public and reducing the manual work required to respond when exposures do slip through.
GitHub and Microsoft Applied Sciences have collaborated on a fine-tuned classifier designed to expand push protection to unstructured secrets. The model evaluates multiple candidate secrets in under two milliseconds and has the potential to more than double the volume of secrets that can be prevented from reaching public code.
Outpaced, not careless
A new exposed secret appears in publicly visible code approximately every two seconds, with the rate doubling annually over the past three years. Public commentary has quickly attributed this to AI making developers less cautious.
Nine quarters of GitHub data tell a different story. Between Q2 2024 and Q2 2026, the volume of screened pushes grew 2.84 times while pushes containing credentials grew 2.59 times. Across this nine-quarter period, no statistically significant trend emerged in the rate at which individual pushes contained credentials. The data instead suggests developers are more aware of exposure risks than before and increasingly unwilling to tolerate them. Over the same span, the share of push-path blocks that developers chose to override declined steadily from 6.63% to 3.93%, contradicting claims that agents are driving developer negligence.