GitHub notes AI agents are involved in one in three pull requests, urging scaled secret protection

GitHub data shows that one in three pull requests involves an AI agent, up from less than one in ten a year ago, suggesting most future code may be agent-written. Across nine quarters, the prevalence of credentials in public pushes showed no statistically detectable trend, and developers actively reduced the share of overridden push-path blocks from 6.63% to 3.93%. GitHub introduced a fine-tuned classifier with Microsoft Applied Sciences that assesses candidate secrets in under two milliseconds, potentially doubling the number of preventable secrets. The mean time to manually revoke a secret is around 40 days, highlighting that human remediation cannot scale with accelerated software creation.