How do you prevent an AI coding agent from committing secrets?

Layer four controls, because each one catches a different failure. Block the agent from reading secret paths, scan at pre-commit, enforce push protection server-side, and issue credentials short-lived enough that a leaked value expires before it is useful. Relying on the scanner alone means every prevented leak already happened in the model's context window.

Read prevention comes first and is the most commonly skipped. Deny the agent filesystem access to .env files, credential directories, keychains, and kubeconfigs at the container or permission level. A secret the agent never read cannot be committed, cannot be echoed into a log, and cannot be sent to a model provider.

Pre-commit scanning with gitleaks or TruffleHog catches what gets generated or pasted anyway. Install as a hook that the agent cannot bypass, which means enforcing it in the sandbox image rather than trusting a local git config.

Server-side push protection is the backstop, because pre-commit hooks are skippable with a flag. GitHub secret scanning push protection and equivalent controls on GitLab and Bitbucket reject the push regardless of what happened locally.

Short-lived scoped credentials change the economics of the leaks that still land. A one-hour token scoped to a staging read role is a cleanup task. A long-lived production key is an incident.

Add rotation on detection as standard practice, since a secret that reached a model provider's logs should be treated as disclosed regardless of whether it reached the repository.

Akto Atlas monitors which credentials and sensitive files AI coding tools are accessing across the organization, which is the visibility that read-prevention policies need to be enforced rather than assumed.

Stop the read. The commit is the second chance, not the first.