STUPID-2026-0047

GitHub Copilot suggested 2,702 valid secrets — 33% of extracted keys were real, live credentials

8.0high
February 10, 2026Source checked

Why 8/10

A study extracted thousands of live credentials from suggestions. Many were still valid, but no specific misuse is documented.

Scope
4/4
Many organisations or the public: a flaw in a widely used product, mass exposure, a large outage
Recoverability
2/3
Partly lost, or loss reported without saying whether it was recovered
Did it happen
1/2
Demonstrated (proof of concept, reproduction, controlled test or near-miss) with no real victim reported
Beyond the user
1/1
Production systems, customers or third parties, or credentials and sensitive personal data

The score is the sum of these four factors. How each factor is scored · scored 2026-10-29

  1. Instruction given

    Autocomplete code that involves credentials or configuration.

  2. Expected behavior

    Never emit real secrets memorized from training data; generate placeholders, not live credentials.

  3. Actual behavior

    Research extracted 2,702 valid secrets from Copilot suggestions — among 8,127 suggestions, 33.2% contained valid, extractable secrets, at least 200 of them real credentials from public GitHub repos. Repos using Copilot leaked secrets at 6.4% vs 4.6% for public repos overall.

  4. Damage

    Real, live credentials surfaced in autocomplete and persisted in the model even after removal from git history — one study found 64% of valid secrets from 2022 were still active and exploitable in 2026, unrotated.

Full write-up

Research from GitGuardian and the Chinese University of Hong Kong showed GitHub Copilot regurgitating real secrets memorized from its training data. Across 8,127 Copilot suggestions, 2,702 contained valid, extractable secrets — a 33.2% valid rate — with at least 200 confirmed as real credentials from public GitHub repositories. Repositories using Copilot leaked secrets at a rate of 6.4%, versus 4.6% across all public repos, a roughly 40% higher leak rate. Worse, these secrets persist inside the model even after being scrubbed from git history: a follow-up found that 64% of valid secrets from 2022 remained active and exploitable in 2026 because nobody had rotated them. It is a systemic hallucination-of-real-data failure: the agent doesn't invent a fake key, it surfaces someone's actual live credential.

Classification

Agent
GitHub Copilot
Failure mode
Security Vulnerability
Root cause
Training Data Gap
Domain
Backend
MIT AI Risk Repository (our mapping)
2.1 Compromise of privacy by leaking or correctly inferring sensitive information · 2.2 AI system security vulnerabilities and attacks taxonomy
Source
Benchmark

Related incidents

8.0
Scan of 5,600 vibe-coded apps found 2,000+ high-impact vulns, 400+ exposed secrets, PII leaks
8.0
CamoLeak: hidden prompt injection turned GitHub Copilot Chat into a silent code/secret exfiltration channel (CVSS 9.6)
6.0
Cline's tool-call JSON repair silently executed truncated write_file and terminal arguments as valid
6.0
Claude (via OpenCode) followed an error message's suggested escalation straight to `bd init --force`, wiping a Dolt-backed issue tracker's entire history
Discuss on Hacker News
Cite this record
StupidLLM. "STUPID-2026-0047: GitHub Copilot suggested 2,702 valid secrets — 33% of extracted keys were real, live credentials." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0047/ (accessed 2026-10-30). CC BY 4.0.

← STUPID-2026-0046By IDSTUPID-2026-0048 →

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.

This database is callable over MCP — query it from inside your agent.