Hardcoded credentials in public MCP files open door to cyberattacks

As the Model Context Protocol rapidly becomes the standard for connecting AI coding agents to enterprise tools and data, it is introducing a major security blind spot. New research from Hush Security found that one in eight credential slots in public GitHub MCP configuration files contain hardcoded secrets -- including API keys, passwords and access tokens.

Originally created as an open standard to streamline how language models query external databases and developer environments, MCP has quickly become the connective tissue for agentic AI. MCP config files tell AI coding agents which tools to access and how to authenticate -- making them a high-value entry point for attackers looking to pivot into sensitive corporate systems.

"CISOs should be very worried," said Keith Guttridge, analyst at Gartner, adding that all an attacker would have to do to exploit the MCP config files is cut and paste them into an AI agent. "That is all it takes. No need to have any technical understanding at all."

Researchers analyzed around 82,000 public MCP config files across more than a dozen coding agents and found 12% of credential slots hardcoded a credential literal. That means anyone with an internet connection could easily find those secrets and potentially use them to access associated applications, services and data. Among hardcoded credentials, 24% were both non-expiring and broad-scope, granting indefinite, extensive access to databases, workspaces and other enterprise assets.

"Worse, it grants that access to an agent, not a person," the Hush Security researchers wrote. "An MCP server acts under this identity autonomously: no human in the loop, no joiner-mover-leaver process to revoke it, often no record of who created it."

Matthew Smith, a virtual CISO and management consultant specializing in cybersecurity risk management and AI, warned that threat actors could use exposed credentials in MCP config files to both steal private data and run up massive AI token bills on the organization's dime. According to researchers, the hardcoded credentials in public GitHub repositories included Anthropic and OpenAI API keys.

"This threat is real, being exploited today, and should be a top concern for CISOs with development in their pipeline," Smith told TechTarget. "Attackers are interested in getting AI keys to feed their token needs. These keys can be reused and incur serious costs to an organization."

Tackling MCP risk exposure

Experts agreed that, given the high stakes, CISOs should assess their MCP risk exposure this week.

"This is a 'now' problem," Gartner's Guttridge said, adding that any organization with AI agents -- sanctioned or unsanctioned -- likely already uses the MCP protocol to connect those agents to enterprise systems. "If you haven't started governing MCP, you are already playing catch-up."

Importantly, the Hush Security report noted, deleting a hardcoded credential from the current config file does not remove the secret from Git history. Rather, researchers found credentials were still buried in past versions of the code. "The only thing that actually ends the exposure is rotating the credential at the provider," they wrote.

In addition to rotating any exposed credentials, experts recommended CISOs take the following steps.

• Review MCP server configurations for hardcoded variables. Credential slots should use safe patterns -- e.g., ${VAR} expansion, client-native prompts, secret managers or placeholders.
• Manage MCP server access. Adopt an AI or MCP gateway or use an MCP aggregator.
• Assess detection capabilities. Find out whether currently deployed network detection and response platforms and endpoint management systems can detect unapproved use of MCP clients and servers.
• Upgrade to the latest version of MCP. Ensure developers use the 2026-07-28 Model Context Protocol specification, which offers additional security controls.

The researchers' findings underscore dual AI security challenges for CISOs, added Brandon Dixon, CTO and cofounder of Ent, an AI cybersecurity company. Firstly, CISOs must secure internal AI software development processes; secondly, they need to know which privileged resources users are connecting to AI models through MCP servers.

"This is an immediate call to action," he added. "AI is being used inside the organization whether the CISO has approved the software or not."

Alissa Irei is an Informa TechTarget news reporter covering cybersecurity.