Stolen AI credentials flood dark web as 6.2 million keys expose enterprises

Stolen credentials for AI tools are flooding criminal markets, with over 6.2 million already in circulation. A recent study also found thousands of exposed OpenAI access keys, raising concerns about security risks in AI adoption. Experts warn that poor coding practices and weak safeguards are making enterprises vulnerable to costly breaches.

On March 23, 2026, researchers from Cyble Research and Intelligence Labs and Vicarius revealed that more than 8,000 unique OpenAI credentials were publicly accessible online. These exposed keys could allow unauthorised access to AI systems, yet the report did not detail how many businesses faced direct financial or operational harm. The issue extends beyond OpenAI, with over 24,000 secrets found in Model Context Protocol (MCP) files on GitHub alone.

The problem is partly driven by 'vibe-driven coding,' where developers prioritise speed over security when integrating AI tools. AI-powered coding assistants now leak secrets at a rate of 3.2%—over twice the rate of human-written code. By late 2026, service accounts and API tokens in enterprises are projected to outnumber human users by 50 to one, increasing exposure risks.

GitHub responded on March 10, 2026, by expanding its secret scanning with 28 new detectors for AI and cloud credentials. The platform now blocks code uploads if highly sensitive secrets are detected under its push protection standard. Despite these steps, industry leaders argue that DevSecOps must evolve further, embedding secret scanning directly into AI chat interfaces and development workflows.

One severe case of 'AI jacking' saw a company charged $82,000 in just 48 hours after attackers exploited exposed credentials. Such incidents highlight the urgent need for tighter controls as AI adoption accelerates.

The surge in stolen AI credentials and exposed secrets points to growing security gaps in enterprise systems. With service accounts soon dominating access points, businesses face higher risks of financial losses and system compromises. Developers and platforms are under pressure to strengthen protections before vulnerabilities escalate further.