New research from Hush Security found that 12 percent of credential slots across roughly 82,000 public Model Context Protocol configuration files on GitHub contain a hardcoded secret, rather than a reference to a secrets manager or environment variable. The files span the config formats used by Claude Code, Cursor, VS Code, Windsurf, Gemini, OpenAI Codex, JetBrains and other coding agents that connect to external tools and data through MCP. Of those hardcoded secrets, 55 percent carry no vendor-recognizable token format at all, meaning standard scanners built to catch a known key pattern miss them by design.

The scope of what those credentials unlock is the sharper finding. Fifty-three percent of leaked credentials with a definable scope grant organization-, account-, workspace- or database-wide access, and 80 percent of credentials that carry an expiry policy are set to never expire by default. Combined, 24 percent of hardcoded secrets in the dataset are both broad-scope and permanent. Hush also checked Git history on 7,681 credential-bearing files and found 243 cases where a secret had been deleted from the current version but was still recoverable from an earlier commit, on top of 1,394 secrets still live today.

“The instinct every security team has trained for years, to scan for secrets, block the commit, and rotate what leaked, isn’t nearly enough here,” said Micha Rave, CEO and co-founder of Hush Security. That is the real takeaway for identity teams: MCP credentials are a fast-growing category of non-human identity that inherited API keys’ access-sprawl problems without inheriting the tooling built to catch them, since more than half of what Hush found does not match the patterns secret scanners are tuned for. Treating an MCP config file as an ordinary environment file, rather than a live non-human identity with broad, often permanent access, is the gap this report quantifies.

CyberTech has covered the credential risk inside AI agent tooling before, including a self-propagating worm that specifically hunted AI agent credentials and a hijacked coding assistant used as a supply-chain delivery mechanism.

Source: PR Newswire