Stolen AI credentials fuel a wave of costly cyberattacks on businesses

A surge in stolen AI credentials is exposing businesses to costly attacks. Criminals now exploit leaked keys to hijack accounts, running up massive bills in what's known as 'AI jacking'. In one case, a single breach led to $82,000 in charges within just two days.

The issue stems from rapid, unchecked coding practices—often driven by AI tools—where secrets slip through the cracks far more often than in traditional development.

On 10 March 2026, GitHub expanded its secret scanning tools, adding 28 new detectors for AI and cloud credentials. The move came after over 24,000 exposed secrets were found in files linked to the Model Context Protocol (MCP). GitHub also now blocks code uploads if highly sensitive secrets are detected, enforcing stricter 'push protection' rules.

Yet the problem persists. AI-powered coding assistants leak secrets at a rate of 3.2%—more than double that of human-written code. Over 8,000 unique OpenAI credentials alone were left exposed, accessible to anyone with a web browser. Worse still, 64% of secrets discovered in 2022 remain active today, showing how rarely credentials are rotated or revoked.

Criminal forums already trade 6.2 million stolen AI tool credentials, most lacking two-factor authentication. Experts warn that by the end of 2026, service accounts and API tokens will outnumber human users in enterprises by 50 to one. This shift towards automated, agent-driven development is making the problem harder to contain.

The root cause? Modern 'vibe-driven coding', where AI-generated code is deployed quickly, often without proper security checks. Attackers seize on these gaps, using stolen keys to flood victims' accounts with expensive queries—leaving businesses with sky-high bills and little recourse.

The scale of exposed credentials highlights a growing security gap in AI-driven development. With millions of stolen keys in circulation and weak protection measures, businesses face mounting risks. Without stricter controls, the financial and operational fallout from these breaches is set to worsen.