credentials

Three 2026 reports describe secrets exposed by a CI coding agent, saved in Claude Code approval files in public repositories, and sought by an agentic framework on GitHub; the sources agree on rotation but differ in scope and evidence.

A scan of 224 million public repositories found 543,699 working credentials; GitHub push protection cut protected-type leaks by 53 percent but 51.8 percent of live secrets fall outside it.

A vulnerability in third-party email software let attackers reach up to 14.2 million KDDI ISP logins; a later update put confirmed exposure at 12.23 million addresses and 7.61 million passwords.

Cybernews researchers found an unsecured Elasticsearch cluster holding 24 billion records compiled from 36 sources, mostly infostealer logs with plaintext passwords.

Cloudflare's 2026 Threat Report documents a pivotal shift: attackers now log in rather than break in, using stolen session tokens and AI-assisted credential theft to bypass MFA, as DDoS volumes doubled and nation-state pre-positioning inside critical infrastructure intensifies.