al-ice.ai

The Config Is the Credential Store: Three Independent Counts of Secrets in Public MCP Files

Agent & Supply Chain Security by al-ice.ai Editorial

Three research teams, three datasets, one finding: the configuration files that wire AI coding agents to their tools are leaking live credentials at scale. Hush Security’s 8 October 2026 audit of roughly 82,000 public MCP configuration files found a hardcoded secret in one in eight credential slots — and nearly a quarter of those secrets neither expire nor stay scoped. GitGuardian’s State of Secrets Sprawl 2026 independently counted 24,008 unique secrets in public MCP files, 2,117 of them verified valid against live services. Flare’s 7 October audit adds a third, more conservative count with the same direction of travel. None of the three teams coordinated; all three describe an exposure surface that barely existed two years ago and now sits at the centre of enterprise agent deployments.

This is the credential half of the MCP story we have been tracking from the protocol side — the TypeScript SDK OAuth client flaw, the first MCP flaw to reach CISA’s KEV catalog, and the 15,465 unvetted public MCP servers. Those were defects in code. This one is a defect in practice: developers pasting keys into the file the agent reads, then pushing the file to GitHub.

Inside the three counts

Hush Security (8 October, via TechTarget). The largest corpus: ~82,000 MCP files spanning more than a dozen coding-agent ecosystems. Hush measured credential slots — fields meant to hold a key, token or password — and found 12% contained a hardcoded literal rather than an environment reference or vault lookup. Of those, 24% were both non-expiring and broad in scope: standing access, not a one-hour token. The material included Anthropic and OpenAI API keys, cloud keys, plaintext passwords, OAuth tokens, and database and internal-workspace credentials. That mix matters beyond the obvious: an exposed AI-provider key converts directly into resellable compute — the LLM-jacking economy CERT-EU flagged in its September 2026 Cyber Brief — giving a leaked key cash value on top of whatever access it grants.

GitGuardian, State of Secrets Sprawl 2026. A different dataset, same verdict: 24,008 unique secrets in public MCP-related configs, 2,117 confirmed live. Two figures in that report deserve isolation. First, secrets tied to AI services grew 81.5% year over year — the fastest-growing leaked-secret category GitGuardian tracks across the entire public GitHub corpus, which means this is not generic DevOps hygiene decaying but a new leak source outpacing every old one. Second, GitGuardian measured a 3.2% secret-leak rate in Claude Code-assisted commits specifically, tying the sprawl directly to AI-assisted coding workflows: the more the agent writes, the more the agent pastes.

Flare (7 October). The conservative count: 2,327 MCP-configuration records, 12,446 after broader deduplication, 438 distinct credentials — 218 once one large concentrated harvesting operation is excluded — with 96 records holding a live, extractable secret. Flare’s distinctive contribution is not the count but the corollary: even a clean MCP file leaks topology. A file that correctly references STRIPE_SECRET_KEY or INTERNAL_CRM_TOKEN without exposing values still tells an attacker exactly which systems the organisation has wired its agents into — a ready-made reconnaissance map. The three datasets use different sampling and different definitions, so the numbers do not add; the direction does.

Why this exposure window runs longer than the classic leaked-key story

Cloud providers and GitHub built automated revocation for exposed AWS and Stripe keys years ago; a leaked cloud key can die within minutes. MCP config files are newer, more varied in format, and not yet uniformly covered by those scanners — which is why Hush’s non-expiring quarter stays usable for months or years after first indexing. Neither Anthropic nor GitHub had issued a public statement specifically addressing the Hush findings at the time the coverage was written; we time-bound that observation rather than assert it as a standing fact.

The mechanism is also stickier than a bad commit. An MCP file is written once by a developer configuring a personal assistant, not reviewed as application code, and rarely rotated — then read on every agent launch, with its contents flowing into tool results, session transcripts on disk, and any tracing backend. One practitioner’s detailed 12 October hardening account traces the full fan-out: a secret pasted in an MCP env block reaches the model provider’s context, the ~/.claude/projects/*.jsonl transcript, and the trace store in a single debugging session — usually when the agent opens the config because the server “won’t start.” Helpfulness is the exfiltration vector: the leak happens while the agent is trying to fix something.

Set this beside the GhostAction October burst, which planted credential-stealing workflows across tens of thousands of repositories to harvest exactly these classes of secret. One campaign steals credentials from repositories; three studies show developers publish them voluntarily. The attacker’s collection problem is being solved from both ends.

What to take from it

  • Scan your organisation’s public MCP files this week, not your dependencies. Pattern-match known MCP filenames and directory structures across your GitHub footprint the way an attacker’s scraper would, and revoke anything live. The 2,117-valid figure says a meaningful fraction of what you find will still authenticate.
  • Replace literals with references the runtime resolves. Vault or secret-manager lookups at launch — never a usable secret in the file — so that a file ending up public costs you topology, not access. Topology leakage is real but a lesser failure.
  • Treat AI-service keys as the fastest-growing category they are. Scope them narrowly, expire them aggressively, and budget-alert them: a leaked provider key burns money from the first minute, which makes it worth stealing even where it grants no data access.
  • Assume transcripts and traces already hold secrets. Anything an agent has read in a debugging session lives in session logs and trace backends. Rotate after incidents, and put secret-scanning hooks on tool inputs — advice in a system prompt does not survive a long session or a prompt injection.
  • Separate the credential from the agent’s process. Credentials held by the MCP server side, with the client configured as a bare URL and no env block, plus a sandbox the agent cannot read its way out of, is the shape that survives the “why won’t the server start” debugging session.

Verification note: the Hush Security figures (~82,000 files, 12% hardcoded slots, 24% non-expiring and broad-scope, 8 October publication, first reported by TechTarget), the GitGuardian figures (24,008 unique secrets, 2,117 confirmed valid, 81.5% year-over-year growth in AI-service secrets, 3.2% Claude Code-assisted commit leak rate) and the Flare figures (7 October, 2,327 records, 12,446 deduplicated, 438/218 credentials, 96 live secrets, topology-leakage corollary) are carried as reported in the tech-insider.org synthesis of 9 October, read first-hand in full; the GitGuardian 24,008 figure is independently corroborated by the practitioner account linked above, also read first-hand. The CERT-EU September Cyber Brief LLM-jacking reference, the CVE-2025-59536 / CVE-2026-21852 Claude Code project-file CVEs, and the “no statement from Anthropic or GitHub” observation are carried strictly as that synthesis reports them and are time-bound to its writing. Raw counts across the three studies use different methodologies and must not be summed. No MCP configuration files were cloned, no exposed credential was tested, and no repository was accessed beyond the public reporting linked here; the characterisation of the failure as practice rather than protocol defect, and of helpfulness as the exfiltration vector, is our editorial analysis.

Sources: