Industry trends and reports
We sent one initialize request to every remote MCP server in the official registry. 71.3% of 22,027 responding servers opened a session with no header authentication, and 3,705 credential fields sit in tool arguments. Three of them are marked secret.
A September 2026 sweep of 33 public surfaces confirmed 23,912 active credentials. Privilege context was established for 7,468; 1,277 had permission to issue another key. Actual re-issuance was not tested.
Count observed locations, distinct credential records and verification states separately. Define scope and check time before reporting exposure.
How Cremit Platform finds exposed credentials, verifies supported types, and routes findings to an owner, with clear limits.
An agent workflow may cross several identity boundaries. Trace the actual grant, source location, permissions and owner before judging a leaked key.
An exposed key is a lead. Connect it to its issuer, principal, permissions, workload, and owner before closing the access path.
A leaked Slack incoming webhook is usually triaged as low severity: write-only, one channel, no data access. The moment an AI agent reads that channel and can act with tools, that write-only primitive becomes an indirect prompt injection path into the agent's privileges. Here is the full kill chain, the exact preconditions, and how to defend it.
An old source record and an active key do not establish key age. Check when the value appeared, issuer status, permissions, and dependencies.
A public commit proves exposure, not misuse. Check validity, permissions, issuer logs, and dependent workloads before closing the incident.
A sourced reading of the 2025 Verizon DBIR, with practical steps for credential inventory, leak prevention, and response.
MCP connects agents to tools; A2A connects agents to each other. Map authentication, token scope, and exposed credentials at every hop.
Optional cookies count visits, identify visiting companies, and measure ads. You can decline. Cookie policy