Post cover image

August 27, 2026

The AI Coding Tool in Your Editor Is Leaking Your Company’s Secrets

38% of Fortune 500 companies have had security incidents from AI coding tools. Here’s exactly how it happens — and the three ways you’ve…

By Raj Kanjariya

9 min read

AI Security • Developer Security • Enterprise AI • Code Privacy • Secure Coding • Cybersecurity

38% of Fortune 500 companies have had security incidents from AI coding tools. Here's exactly how it happens — and the three ways you've probably already been exposed.

It's a Friday evening. A developer at a fintech startup is racing to fix a production bug before the weekend.

She opens GitHub Copilot, pastes in the problematic function, and starts typing. Copilot autocompletes beautifully. It sees her database connection pattern and helpfully fills in the structure — she just needs to drop in the real credentials. She does. Copilot suggests the fix. Clean. Fast. She commits, pushes, ships, closes her laptop.

By Sunday, an automated scanner has found her credentials in the public git history.

By Monday morning, her company's customer database has been accessed.

She didn't make a mistake. She did exactly what the tool was designed to help her do. She trusted it the same way she trusts her IDE, her linter, her version control. She had no reason not to.

That trust is the problem.

The Number Nobody Is Talking About

Before we get into how this happens, let's sit with a single statistic.

38% of Fortune 500 companies have experienced security incidents related to AI coding tools.

Not 3%. Not a rounding error. 38%.

The tools that are now used by 26 million developers and 90% of the Fortune 100 have caused confirmed security incidents at over a third of the largest companies on earth. This isn't a fringe risk. It's a standard outcome.

And the rate isn't getting better as developers get more experienced with the tools. It's getting worse as the tools get more capable — because more capable tools touch more of your system.

GitGuardian's 2026 State of Secrets Sprawl report found AI-assisted commits leaking secrets at roughly double the GitHub-wide baseline rate. Claude Code-assisted commits peaked at 31 secrets per 1,000 commits — 2.4x the baseline rate.

The same report found something even more alarming about the MCP config files that connect AI assistants to external tools: 24,008 unique exposed secrets currently sit on public GitHub from these files, with 2,117 of those still valid when discovered.

Still valid. Right now. Today.

This isn't ancient history from when AI coding tools were new and rough. This is the current state of AI-assisted development in 2026, after years of iteration, after billions in investment, after the tools became mainstream.

None

Three Ways Your Code Is Leaving the Building

Most developers have a vague sense that AI coding tools "send your code somewhere." The reality is more specific — and more dangerous — than that vague intuition suggests.

There are three distinct mechanisms. Understanding them changes how you use these tools.

1. Context Window Exposure

When Copilot, Cursor, or Claude Code generates a suggestion, it doesn't just look at the line you're typing. It reads the surrounding context — nearby functions, imports, configuration patterns, sometimes entire files.

The highest-frequency risk is not model training. It is context-window leakage: secrets and sensitive code sent to the cloud for inference. Contracts do not stop a developer from pasting a production key into a prompt.

Your enterprise tier contractually protects your code from being used for training. It does not protect against the code being transmitted to cloud servers for inference in the first place. That transmission happens with every suggestion.

GitHub Copilot sends code context — the file you are editing and surrounding files — to GitHub's servers to generate suggestions. With Copilot Business/Enterprise, this context is not stored beyond the current session and is not used for training. However, it is transmitted.

The danger is what's in the files being transmitted. A .env file open in a neighboring tab. A configuration file with a hardcoded API key from a "temporary" test that became permanent. A stack trace with internal hostnames pasted into the chat. None of these are the code you're asking about — but they're in the context window, and they travel.

2. The Packages That Don't Exist

This one is genuinely new. And it's the insight that will make you rethink how you install dependencies from AI suggestions.

It starts with a simple observation: AI models sometimes hallucinate package names. They suggest pip install fastparserx or npm install react-codeshift — packages that sound completely legitimate but don't exist in any registry.

Historically, this was just annoying. An installation error. The developer Googled the real package name and moved on.

Then attackers noticed.

In January 2026, Aikido Security's Charlie Eriksen found one such made-up npm package, react-codeshift, that AI-written instructions had already spread to 237 code projects, with agents still trying to install it daily. He registered it himself before any attacker could, so it caused no harm.

The name is a textbook AI hallucination — a conflation of two real packages, jscodeshift and react-codemod, mashed together by a model that wanted to be helpful and didn't know it was inventing something that didn't exist.

The unused-imports npm package represents one of the clearest documented cases of confirmed malicious exploitation. AI models hallucinate this name instead of the legitimate eslint-plugin-unused-imports. As of early February 2026, the malicious package was still available and recording approximately 233 weekly downloads despite having been security-held by npm.

233 developers a week. Still installing malware. Because their AI coding assistant told them to.

Security researchers registered the package name huggingface-cli on PyPI as a test. Within 48 hours, thousands of downloads poured in from corporate IP ranges. No malicious payload was shipped — but the lesson was brutal: if a harmless test scored thousands of installs, real attackers would enjoy the same distribution channel with zero pushback.

This attack is called slopsquatting — a term coined by Seth Larson at the Python Software Foundation. It exploits the "sloppy" side of language models: their tendency to invent plausible-sounding dependencies.

The attack model is elegantly simple. Scan AI-generated code for package names. Check which ones don't exist. Register them before a real attacker does — or if you're the attacker, register them with a malicious payload. Then wait. AI assistants will suggest your package millions of times to developers who trust the suggestion completely.

An additional dimension compounds the problem: researchers found that 8.7% of Python packages hallucinated by models actually exist in the npm registry. A developer working in Python could unknowingly install a JavaScript-ecosystem package — or an attacker could register that name on PyPI as a payload delivery mechanism.

Every time you run pip install or npm install from an AI suggestion without verifying the package exists and is legitimate, you're playing this lottery.

None

3. The Config File Nobody Audits

Here's the part that should concern enterprise security teams more than anything else.

AI coding assistants connect to external tools — databases, APIs, GitHub, Slack, Jira — through a system called MCP (Model Context Protocol). The connections are configured through local files: mcp.json, .cursor/mcp.json, or similar names depending on the tool.

These files typically contain API keys and tokens in plaintext so the assistant can authenticate to the connected service.

They are easy to commit by accident. They are rarely covered by the same secret-scanning rules as application code. They are often created quickly, when a developer is setting up their environment, and then forgotten.

According to GitGuardian's 2026 report, 24,008 unique exposed secrets on public GitHub already come from these files — with 2,117 of those still valid when discovered.

2,117 live credentials. In config files. That developers forgot were there.

And this is the current state, with the tools being relatively new. As MCP adoption grows — as more developers connect their AI assistants to more external services — this number will grow proportionally.

What Your Tools Actually Send (Versus What You Think)

There's a lot of confusion about which AI coding tools train on your code. The confusion creates false confidence. Here's the actual picture:

None

The training question is the one everyone asks. It's not the most important question.

The real risk is Context Window Leakage: secrets sent to the cloud for inference. Contracts do not stop a developer from pasting a production key into a prompt.

No contract protects against a developer who copy-pastes a .env file into a chat window asking for help debugging. That transmission is intentional, voluntary, and completely outside any enterprise data protection agreement.

Gartner reports that at least 80% of unauthorized AI transactions come from internal policy violations rather than malicious attacks.

Eighty percent. The biggest threat isn't attackers compromising your AI tools. It's your own developers using them in ways the policy doesn't cover — because the policy was written before anyone understood what the tools actually do.

We've Seen This Movie Before

In 2011, a small startup uploaded their entire customer database to Amazon S3 to handle a traffic surge. They were moving fast. They forgot to set the bucket permissions to private. The data was publicly accessible for six months before anyone noticed.

That story repeated hundreds of times between 2010 and 2014. Companies moved to cloud storage quickly, enthusiastically, and without fully understanding that the defaults were public-friendly rather than secure-friendly. The productivity gains were real. The security assumptions were wrong.

The pattern with AI coding tools is identical.

Developers adopted Copilot and Cursor with the same speed, the same enthusiasm, and the same incomplete understanding of what the tools do with the code they touch. The productivity gains are real — developers report 40–55% faster code completion. The security assumptions are wrong.

The S3 era ended with mandatory bucket-level encryption defaults, org-level permissions policies, and automated misconfiguration detection. It took about four years of incidents to get there.

We are approximately two years into the AI coding assistant security reckoning. Based on historical pattern, we have two more years of worsening incidents before the tooling catches up.

The developers who harden their setup now won't be part of the statistics.

How to Actually Fix This

This isn't complicated. It takes about 20 minutes for an individual developer. Longer for a team, but the controls are real.

For individual developers — do this today:

# 1. Add MCP config files to your .gitignore
# These should NEVER reach a remote repository

echo ".cursor/mcp.json" >> ~/.gitignore_global
echo "mcp.json" >> ~/.gitignore_global
echo ".mcp.json" >> ~/.gitignore_global
git config --global core.excludesfile ~/.gitignore_global

# 2. Configure GitHub Copilot content exclusions
# In your repo, create .copilotignore:
.env
.env.*
*.pem
*.key
config/secrets.yml
internal-config.*
# Add anything containing credentials

# 3. Run a quick audit of what's already exposed
# Install truffleHog and scan your recent commits:
pip install trufflehog
trufflehog git file://. --since-commit HEAD~50 --only-verified

Before running any AI-suggested package installation:

# BEFORE: npm install react-codeshift
# (AI suggested it, you trust it, you run it)

# AFTER: verify first
npm info react-codeshift  # Does it exist? Who published it?
# If this returns "npm error 404" — it doesn't exist.
# Don't install it. Find the real package manually.

# Even better — use a package validation tool
# Socket.dev browser extension shows package risk before install
# pip install socket-security  # for Python environments

For engineering leads and CTOs:

Three controls that cover 80% of the risk surface:

  1. Secret scanning on every commit. GitGuardian, GitHub's built-in secret scanning, or truffleHog. All three detect the most common secret formats before they reach the remote. This is table stakes in 2026 and takes an afternoon to set up.
  2. Copilot Content Exclusion policy at the org level. GitHub lets you define which files and patterns are never sent to Copilot as context. Set this for your entire organization, not per-repo. Takes 30 minutes.
  3. MCP config audit. Search your GitHub organization right now for mcp.json files. Look at what's in them. You will likely find credentials. Rotate them. Then add those files to your organization's secret-scanning baseline.
None

The Save-This List

Three things worth writing down:

1. AI coding tools don't leak your code to the model training data (in most enterprise tiers). They leak it in transit — and through developer behavior that no contract covers.

2. Slopsquatting is real, active, and growing. Every pip install or npm install from an AI suggestion that you don't verify is a bet that no attacker has registered that package name yet.

3. Your MCP config files probably contain plaintext credentials. They probably aren't in your secret-scanning rules. They probably aren't in your .gitignore. Check them today.

The One-Sentence Insight

We adopted AI coding tools with the same enthusiasm we adopted cloud storage in 2010 — and we're making the exact same mistake: treating productivity gains as proof that security is solved, when the two problems have nothing to do with each other.

Conclusion

The developer in that Friday evening scenario didn't make a human error. She made a tooling assumption — that the tools she trusts to make her faster were also designed to make her safer.

They weren't. Not by default. Not without configuration. Not without the kind of deliberate policy that takes time to write and rarely gets written before the first incident.

38% of Fortune 500 companies have had security incidents from AI coding tools. That number represents real breaches, real investigations, real customers affected.

The 62% who haven't had an incident fall into two categories: companies that have hardened their setup deliberately, and companies that haven't had their incident yet.

The tools are extraordinary. The productivity gains are real. Use them.

Just spend 20 minutes today making sure they're not taking your secrets with them.

#Programming #Cybersecurity #AI #WebDevelopment #DevOps #GitHub #SoftwareEngineering #Security