Hardcoded credentials for AI coding tools have been discovered in publicly accessible configuration files on GitHub, potentially exposing sensitive access tokens and API keys. The findings come from a recent analysis of approximately 82,000 configuration files, revealing that 12% of credential slots contained a hardcoded literal.
The research identified these exposures by searching public GitHub repositories for common configuration filenames associated with major coding agents. Investigators then examined environment variables and authentication headers within these files, classifying how authentication information was stored. Categories included hardcoded values, environment-variable references, client-managed prompts, secret-manager references, placeholders, and empty fields.
To pinpoint likely secrets within hardcoded values, researchers employed provider-specific patterns and Shannon entropy, a measure of randomness often used to identify sensitive data. It is important to note that GitHub's code search indexes only default branches, excludes forks, and limits individual query results, meaning the reported figures are considered lower-bound estimates rather than definitive counts. While some files included in the study were general configuration files, only those declaring an MCP server were counted in the analysis. Researchers did not attempt to authenticate with any services using the discovered values, and some credentials may have been revoked or rotated since their initial commitment.
A significant portion of the hardcoded secrets, 55%, lacked a vendor-recognizable token format. This included 31% classified as opaque bearer tokens intended for internal MCP servers. For these values without a clear provider-specific format, researchers assessed their likelihood of being credentials based on key names, length, entropy, and character patterns. The analysis determined that these values predominantly consisted of vendor API keys, bearer tokens, and database passwords, with non-secret identifiers accounting for a negligible share. No raw secret values were retained during the study, and all findings were aggregated and anonymized to protect individual repositories or authors.
A critical aspect of the vulnerability is that simply removing sensitive information from the latest version of a file does not eliminate it from a repository. Git's version control system retains previous iterations, making deleted values accessible through commit history. The research team examined the history of 7,681 configurations containing credentials, reviewing up to seven revisions prior to the current version. They found 243 instances where a secret had been removed from the current file but remained accessible in an earlier commit. This means that rotating the affected credential at the provider level is essential to end the exposure, as merely deleting it from the current configuration is insufficient.
Of the hardcoded credential literals, 24% were identified as broad-scope and non-expiring by design. Furthermore, 53% of credentials with a classified scope provided extensive access, such as organization-, account-, workspace-, or database-wide permissions. For credentials with an explicit expiration policy, 80% did not expire by default. Long-lived credentials combined with extensive permissions significantly increase the potential impact of an exposure, as a single compromised credential could grant access to multiple resources or critical functions.
The growing use of AI agents further complicates the issue of machine identities. These agents often operate as non-human identities, using credentials to authenticate with systems without direct human intervention. MCP connections, in particular, can grant AI agents permissions to interact with source code, databases, and cloud infrastructure. As the deployment of these agents expands, organizations face increasing challenges in tracking which agents have access, their specific permissions, ownership, and when that access should be terminated.
