People or their agents must be accidentally committing or publishing their repository level secrets and configs with enough regularity that it’s worth scanning.

Totally. I'm sure this campaign was inspired by sloppy vibe coding

There are a few novel ones but I’ve been seeing most of them in my logs for longer than generative AI has existed. This isn’t remotely new, the vector is just getting bigger.