New Research Finds 1 in 8 Credentials in Public MCP Config Files Are Hardcoded Secrets and Most Scanning Can't See Them

Hush Security identified approximately 82,000 publicly accessible Model Context Protocol (MCP) configuration files, highlighting a rapidly expanding and largely unmonitored non-human identity security risk on GitHub. The analysis points to potential exposure from AI-agent and machine-to-machine credentials or configurations being publicly visible, underscoring growing cybersecurity risks associated with enterprise AI adoption.