The Rise of Non-Human Identities and Secret Sprawl:

 Each new AI-enabled workflow quietly creates another machine identity. On average, organizations today juggle dozens of machine accounts per employee (some report ~45 bots for every human). These can be service accounts, integration bots, chatbots, CI/CD pipelines, or AI agents tied to various apps. Each account needs a secret (password, API key, certificate, OAuth token) to connect to other systems. Without strict governance, these secrets proliferate unchecked. In 2024 alone, GitGuardian found over 23.7 million new hardcoded secrets on public GitHub – a 25% year-over-year surge – and most leaked credentials remain valid for months or years. For example, using AI coding assistants correlates with higher leaks: GitHub repos with Copilot enabled leaked secrets 40% more often than average. In short, the convenience of AI and AI automation is feeding a credential sprawl: machine identities outnumber people, secrets multiply, and bad actors only need one weak link to gain a foothold.

Amplified Risks in Chained Workflows (A2A, RAG, and Orchestration)

Agent-to-Agent (A2A) Threats:

Modern AI agents increasingly coordinate with each other (A2A) and with data tools. In these multi-agent systems, one compromised component can poison the rest. For example, naming and impersonation attacks can trick agents into talking to malicious “look-alike” services. Research has shown that if a fake MCP/A2A server or Agent Card uses a deceptive name (e.g. finance-tool-mcp vs. financial-tools-mcp), an AI agent may unwittingly connect to the bad endpoint. This can let an attacker capture access tokens or sensitive data intended for a legitimate tool. In effect, one rogue agent in a network of agents can siphon secrets or inject malicious instructions into the workflow chain.

Retrieval-Augmented Generation (RAG) Risks:

 Many automation bots now use LLMs with RAG pipelines – pulling in data from internal knowledge bases (Wiki, Confluence, vector DBs) to answer questions. This can inadvertently expose secrets. For instance, suppose an AI chatbot is fed an internal Confluence page that contains a plaintext API key. The bot might regurgitate that key to any user who asks the right question, or leak it in logs. In one example, a support chatbot retrieved developer credentials from an internal page and suggested them to a user, all without an admin realizing the leak. Even without malice, RAG agents process prompts and data that often include sensitive content (PII, internal notes, financial figures, etc.). If the RAG pipeline or vector database is misconfigured or exposed, all that private information can spill out. In fact, a recent security report found dozens of open vector DB instances on the public internet containing corporate emails, customer PII, and more. Worse, an attacker can pollute or corrupt an exposed vector store so that every future query returns poisoned or malicious data, without anyone noticing. In complex automated flows (for example, a webhook in Zapier calling an external AI service, which then posts a result back into Slack), a single misused token or stray data leak can cascade through multiple systems.

Orchestration Overreach:

The more services are chained together, the more subtle failures can propagate. Automation platforms often connect dozens of tools via OAuth or API bridges. If any connector holds broad access (e.g. a Zapier “team” with admin rights), an attacker can exploit that to move laterally. Ghost login attacks illustrate this: even after a user changes their password, an existing workflow’s OAuth tokens may remain active, allowing a persistent backdoor. In Zapier, for example, a hacker who had linked to a user’s Dropbox via Zapier was still able to siphon off data after the user reset their login, because the OAuth token in the Zap remained valid. Similarly, orchestration errors (misconfigured filters or multi-step actions) can cause an agent to flood sensitive outputs into the wrong channel or continue a task past its intended scope. In short, chains of AI actions multiply the stakes: a leak or compromise in one link often propagates to others.

Mitigation and Best Practices

AI automation will become critical, we are not the only ones looking at it. The GitGuardian security framework for AI agents highlights five key controls – Audit, Centralize, Prevent, Improve, and Restrict – to manage non-human identities and secrets. In practice, organizations should adopt secrets hygiene and governance akin to that for human accounts. First, inventory all automation accounts and the credentials they hold (build a data flow map). Audit and Clean Up: Eliminate or rotate any hardcoded secrets in source files, docs, or automation steps. Use tools (like GitGuardian or Reco) to scan code repositories, logs, and cloud configurations for stray keys. Once a credential is exposed, revoke or rotate it immediately (remember that 70% of leaked secrets remain valid for years if untouched). Where possible, move to dynamic, ephemeral credentials (e.g. cloud-managed tokens, short-lived IAM roles) instead of static long-lived keys.

Least Privilege and Access Control: Grant each automation the minimal permissions it needs. For example, if a Zapier workflow only needs to post to one Slack channel, use an app credential restricted to that channel – not a global workspace token. Implement strict approval processes for any new bot or integration. Use enterprise versions of tools when available, as they offer audit logs and managed security. Enforce 2FA on all related user accounts, and review OAuth grants regularly to catch “ghost” connections.

Secure RAG Pipelines: For workflows using retrieval-augmented generation or vector stores, lock down those data sources. Ensure any knowledge base or database behind an AI has robust authentication (turn off anonymous access). Tokenize or mask truly sensitive fields so they never enter the AI context. Encrypt data at rest and in transit, and monitor access to vector DBs. Filters should sanitize AI outputs: for instance, program the agent to redact any value matching a credential pattern before returning a response. Be especially cautious with public or personal data: as one analysis warns, RAG systems often ingest sensitive user notes or PII, which must be prevented from leaking.

Continuous Monitoring and “Secure by Design”: Treat AI automations like any critical software. Follow frameworks (such as DHS/CISA’s AI Risk Management Guidelines) that emphasize risk mapping and secure design. Maintain an up-to-date inventory of all AI use cases and the data they touch. Implement logging on every step of your automation flows and regularly review them for anomalies. When integrating third-party agents or APIs, scrutinize their trust boundaries: one best practice is to “sandbox” new workflows with non-sensitive data before granting full access.

Educate and Govern: Finally, ensure the teams (including non-technical marketers and growth hackers) understand these risks. Enforce policies that explicitly forbid uploading classified or regulated data into public AI tools. Provide clear credential management guidance: use vaults or CI secrets storage, never email keys, and rotate passwords routinely. As GitGuardian advises, prioritize both early detection (scanning) and swift remediation (revoking keys) if a leak is found. By centralizing the management of all machine identities and applying these controls (audit trails, limited scopes, and continuous monitoring), organizations can enjoy the speed of AI automation while keeping secrets and identities under control.

Table 1. Common Automation Tools and the Credentials They Touch

Each entry above represents high-value credentials. In marketing and growth automation, these typically include OAuth access to social media/business platforms, service API keys for emailing or analytics, and webhooks that carry data between systems. If any of these secrets are exposed (for example, leaked in a public workflow file or intercepted via a compromised agent), attackers can hijack entire services or exfiltrate sensitive customer data.

Summary and Next Steps

The convergence of AI agents and no-code automation has turbocharged productivity—but it has also created a non-human identity crisis. Machine accounts now far outnumber people, and every new AI-powered workflow adds another potential leak point for credentials and secrets. The risk multiplies when agents communicate (A2A) or fetch data (RAG). To stay secure in this environment, organizations must treat every bot and flow like a first-class citizen in their security policy: govern, monitor, and minimize its access and data. By applying strong secret management (rotation, vaults, push protection), strict access controls, and the auditing and governance guidelines outlined above, teams can harness AI automation with confidence that sensitive passwords and data won’t slip through the cracks.

Sources: Industry reports and analyses underscore these concerns. For instance, GitGuardian’s State of Secrets Sprawl 2025 documents the explosive growth of exposed credentials. Cybersecurity experts also highlight the need to inventory AI use cases and enforce security-by-design for all AI systems. Real-world incidents (e.g. Zapier’s 2025 breach, GitHub Actions supply-chain hacks) illustrate how intertwined AI automation and security really are. The guidance above draws on these analyses to help marketers and growth engineers deploy AI tools safely, with a clear strategy for protecting credentials and identities in an automated world.