Hardcoded API keys, access tokens and other credentials used by AI coding tools have been found in publicly accessible MCP configuration files on GitHub, according to research from Hush Security’s The State of MCP Configuration: The Identity Security Gaps report. The company analyzed around 82,000 configuration files and found that 12% of credential slots contained a hardcoded credential literal, potentially exposing credentials for connected services and systems.
Hardcoded MCP credentials found in public GitHub files
About this summary. This is a short, independently written summary of an article first published by Help Net Security. Cyber Security News did not report or verify the underlying story. Read the original: https://www.helpnetsecurity.com/2026/09/18/hush-security-mcp-credential-exposure-report/
Source attribution: headline and facts are from Help Net Security (helpnetsecurity.com). Summary method: excerpt of the source description. See our source attribution policy and corrections policy.
Related coverage
Credentials Are Still the Shortest Path In
How Brutus grew into an engine that finds your identities, tests them everywhere they’re accepted, and remembers what it confirms. An attacker rarely needs a novel…
Automatic analysis for GitLab is now available
We are thrilled to announce that automatic analysis is now live for GitLab projects on SonarQube Cloud. This zero-configuration feature enables SonarQube Cloud to audit…
Mapping out your unknown: A threat hunter’s guide to GitHub
In this post, we walk through different threats to GitHub and how to detect them.
Infostealers Weekly Report: 2026-09-07 – 2026-09-14
InfoStealers Weekly Report – In this comprehensive report, we provide you with valuable insights into the most pressing threats facing organizations today. As…
How Attackers Abuse Legitimate RMM Tools
In September 2026, a Chase-themed campaign delivered more than 80,000 messages in a few hours. The email presented a secure account statement and directed recipients to…
VU#280377: Dokploy is vulnerable to OS command injection
Overview Dokploy versions 0.29.8 and 0.29.11, as well as commit 24b02f5 on the canary branch, are vulnerable to OS command injection during the backup creation and…