GitHub Copilot suggested 2,702 valid secrets — 33% of extracted keys were real, live credentials
10/10
Severity
Security Vulnerability
Failure Mode
Reproducible
No
Date
February 10, 2026
Expected Behavior
Never emit real secrets memorized from training data; generate placeholders, not live credentials.
What Actually Happened
Research extracted 2,702 valid secrets from Copilot suggestions — among 8,127 suggestions, 33.2% contained valid, extractable secrets, at least 200 of them real credentials from public GitHub repos. Repos using Copilot leaked secrets at 6.4% vs 4.6% for public repos overall.
Damage Assessment
Real, live credentials surfaced in autocomplete and persisted in the model even after removal from git history — one study found 64% of valid secrets from 2022 were still active and exploitable in 2026, unrotated.
Full Report
Research from GitGuardian and the Chinese University of Hong Kong showed GitHub Copilot regurgitating real secrets memorized from its training data. Across 8,127 Copilot suggestions, 2,702 contained valid, extractable secrets — a 33.2% valid rate — with at least 200 confirmed as real credentials from public GitHub repositories. Repositories using Copilot leaked secrets at a rate of 6.4%, versus 4.6% across all public repos, a roughly 40% higher leak rate. Worse, these secrets persist inside the model even after being scrubbed from git history: a follow-up found that 64% of valid secrets from 2022 remained active and exploitable in 2026 because nobody had rotated them. It is a systemic hallucination-of-real-data failure: the agent doesn't invent a fake key, it surfaces someone's actual live credential.
Incident Metadata
- Agent
- Github Copilot
- Failure Mode
- Security Vulnerability
- Root Cause
- Training Data Gap
- Task Type
- feature
- Domain
- backend
- Source
- benchmark