AI agents leak credentials unprompted, but scanner caught every instance in 5,000-call test

·1 views

A developer ran a 5,000-call verification test across five AI models to determine whether agents leak embedded credentials during routine tasks — without any instruction to do so. The experiment used a neutral debug assistant scenario, planting synthetic credentials from ten common families inside realistic crash logs to avoid real-world harm. Results showed that natural credential leakage does occur but is highly uneven across different models. Notably, every instance of leakage was successfully detected by the scanner under test. The findings come against a broader backdrop of rising AI-assisted secret exposure, with GitGuardian's 2026 report recording 28.6 million new secrets leaked on GitHub in 2025 — a 34% year-on-year increase.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

pack.nvim brings modern UI to Neovim 0.12's native package manager

A new Neovim plugin called pack.nvim has been released to provide a rich user interface on top of Neovim's built-in vim.pack API, introduced in version 0.12. The tool delegates core operations such as cloning, updating, and lockfile management to Neovim's native C backend, while adding an interactive floating-window dashboard with real-time status indicators and commit diff previews. pack.nvim supports modern lazy-loading techniques triggered by commands, events, filetypes, and keymaps, without building an isolated ecosystem separate from Neovim's standard plugin directory. All plugins managed through it reside under the standard vim.pack path, and any plugins already installed via vim.pack are automatically adopted without re-cloning. The plugin requires Neovim 0.12 or later and is configured through a straightforward setup block in the user's init.lua file.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds AI Tool That Displays Real-Time Water Cost Per Query

A developer has created JSTJO, an AI chatbot that visibly tracks and displays estimated water consumption with each response, aiming to make AI's environmental footprint tangible to users. The project was prompted by the UN's June 2026 AI Environmental Transparency Initiative, which formally requested standardized water and energy disclosures from AI companies, though compliance remains largely voluntary. Major tech firms have disclosed significant water usage figures — Google reported 10.9 billion gallons in 2025, a 34% year-on-year rise, while Amazon published its first-ever water footprint of 2.5 billion gallons in mid-2026. Researchers estimate each AI query consumes between 10 and 25 milliliters of water when indirect usage from power generation is included, far above the commonly cited 0.3 ml figure that counts only direct data-center cooling. The developer reports that simply seeing a counter deplete in real time changed their own usage habits, citing behavioral economics research showing that making hidden costs visible can meaningfully reduce consumption.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Illinois Law HB5511 May Require Linux and Other OS Makers to Verify User Ages

Illinois has passed House Bill 5511, a new law that could hold operating system developers, including those behind Linux, responsible for age verification of users. The legislation appears to extend age-verification obligations beyond app stores and websites to the operating system level itself. This would be an unusual and technically complex requirement, as Linux is largely developed by a distributed global community rather than a single corporate entity. Critics and observers are raising concerns about how such a law could practically be enforced against open-source projects. The bill marks one of the more far-reaching state-level attempts in the US to regulate minors' access to digital platforms.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

libvctrl 2.0.0 Released as Production-Ready Rust SDK for Custom Version Control

libvctrl 2.0.0 is a Rust-based software development kit designed to help developers build custom version control systems without assembling multiple dependencies manually. The SDK bundles three sub-crates covering contracts, reference implementations, and SHA-512 cryptography under a single unified namespace via the Facade Pattern. It enforces strict safety guarantees at the compiler level, including a ban on unsafe code, panics, and unwrap calls, making it suitable for production environments. The release provides ready-to-use backends such as an in-memory store, binary codec, and SHA-512 hasher adapter, alongside object builders and validators. Future components, including low-level and high-level CLI layers, are planned but not yet implemented.

0 comments Read more at DEV Community