AI DEV ASSISTANTS SOMETIMES EMIT OTHER PEOPLE’S API KEYS

Summary from the TLDR InfoSec newsletter

A group of researchers found that GitHub Copilot and Amazon CodeWhisperer can be coaxed into revealing other people’s API keys. The keys that can be leaked were included in training data as they were accidentally committed in public repositories. The researchers have also released a tool to search for publicly exposed credentials.