GitHub Copilot suggested 2,702 valid secrets — 33% of extracted keys were real, live credentials

Research from GitGuardian and the Chinese University of Hong Kong showed GitHub Copilot regurgitating real secrets memorized from its training data. Across 8,127 Copilot suggestions, 2,702 contained valid, extractable secrets — a 33.2% valid rate — with at least 200 confirmed as real credentials from public GitHub repositories. Repositories using Copilot leaked secrets at a rate of 6.4%, versus 4.6% across all public repos, a roughly 40% higher leak rate. Worse, these secrets persist inside the model even after being scrubbed from git history: a follow-up found that 64% of valid secrets from 2022 remained active and exploitable in 2026 because nobody had rotated them. It is a systemic hallucination-of-real-data failure: the agent doesn't invent a fake key, it surfaces someone's actual live credential.

Github-copilot was responsible for this security vulnerability incident, documented as STUPID-2026-0047 in the StupidLLM AI agent incident database.

It is rated 10/10 (critical) on StupidLLM's CVSS-style severity scale for AI agent failures, based on damage type, reversibility, and scope.

The root cause was classified as training data gap. Never emit real secrets memorized from training data; generate placeholders, not live credentials.

Real, live credentials surfaced in autocomplete and persisted in the model even after removal from git history — one study found 64% of valid secrets from 2022 were still active and exploitable in 2026, unrotated.