MCP Servers Pose Significant Risk to Enterprise Secrets Through Multiple Vulnerabilities
New research highlights critical security flaws in Model Context Protocol (MCP) servers, which can expose sensitive enterprise secrets through misconfigurations, over-permissioning, and prompt injection attacks.
Model Context Protocol (MCP) servers, designed to facilitate AI agent access to enterprise tools and data, are emerging as a significant security risk, potentially exposing sensitive secrets like credentials, API tokens, and service account keys. The protocol, originally introduced by Anthropic, allows AI agents to interact with live systems, but the intermediary MCP server requires access to these sensitive credentials to function. This convenience, coupled with the rapid adoption of AI agents, creates a fertile ground for vulnerabilities that can lead to substantial security gaps before organizations are even aware of the exposure.
The core issue lies in how MCP servers are often implemented and secured. As AI agents evolve from simply providing answers to actively taking actions using Non-Human Identities (NHIs) such as API keys and tokens, the compromise of an MCP server can grant attackers not only access to data but also the ability to act on it within enterprise systems. This shift necessitates a re-evaluation of security practices tailored to this new AI-driven operational layer.
Several common pathways lead to secret exposure via MCP servers. One primary concern is the storage of plaintext credentials within configuration files. Many setups involve pasting sensitive tokens directly into configuration strings, which, if left accessible on disk or accidentally committed to code repositories, become easily readable by any attacker gaining access to the server. This "copy-paste" approach to configuration bypasses standard security controls.
Another significant vulnerability is credential sprawl across ungoverned servers. Without centralized secret management, individual AI agents often manage their own credentials, leading to duplication and scattering of sensitive information across development, staging, and production environments. These scattered, long-lived secrets are rarely rotated due to a lack of inventory, providing static, persistent entry points for attackers.
Prompt injection presents a more subtle threat, where attackers can embed malicious instructions within documents or data that an AI agent accesses. The agent, mistaking these hidden commands for legitimate instructions, may then misuse its tools or inadvertently leak the secrets it was entrusted to protect. This exploits the AI's natural language processing capabilities against its intended function.
Over-permissioning is another common pitfall. Developers, in an effort to streamline development, often grant MCP servers broad permissions that are not subsequently narrowed down for production environments. This "least privilege" violation means that a single compromised agent can access and expose far more sensitive data and systems than necessary for its intended task.
Furthermore, the open nature of MCP server development introduces supply chain risks. As demonstrated by CVE-2025-6514, connecting to an untrusted MCP server, such as the widely downloaded mcp-remote OAuth proxy, could lead to OS command injection and remote code execution, granting attackers direct access to steal credentials from the compromised machine.
To mitigate these risks, organizations must adopt robust security practices. Centralizing secrets in a managed store, using short-lived and automatically rotated credentials, strictly enforcing the principle of least privilege for AI agents, and maintaining human oversight for sensitive actions are crucial steps. These measures aim to secure the new AI layer by applying established security principles to the unique challenges posed by MCP servers and AI agents.