Skip to content
The Injection_
LIVE
LIVElast sweep next in--:--:--

[ RSS ][ JSON ][ llms.txt ]

Credential theft

Also called: secrets leak · token theft

Credential theft in AI security means stealing API keys, OAuth tokens, cloud credentials or passwords through AI tools, agents or their supply chain. Agents often run with a developer's full access, so a hijacked agent or malicious plugin can read and send secrets it was never meant to touch.

How it works

Secrets leak through environment variables and config files an agent can read, tokens passed to the wrong server, malicious packages that harvest keys on install, and prompt injection that asks an agent to print or send them. Leaked AI provider keys are also abused for free model access.

How to defend

Give agents scoped, short-lived credentials instead of personal tokens, keep secrets out of working directories, use secret scanning, and rotate anything an untrusted tool could have read.

Real cases 11 stories

  1. MED

    Vulnerability · VulnCheck · CVE-2026-108865 · CVSS 8.8

    MCP source review: at least 16 unpatched CVEs in three days

    A static source-review campaign by two researchers has produced at least 16 MCP CVEs published October 10 to 12, 2026. The second wave reaches application MCP servers, an inference server sandbox and sub-agent permissions. None lists a fix.

  2. HIGH

    Supply chain · AIR Security

    OpenAI Sesame: an official skill sent app tokens to an unowned domain

    OpenAI Sesame is a flaw in render-deploy, an official OpenAI skill that told coding agents Render private services sit at render-internal.com, a domain Render did not own. AIR Security registered it and received live bearer tokens.

  3. HIGH

    Supply chain · Socket

    GhostAction: new wave scrapes AI provider keys from 346 repos

    A new GhostAction wave added a fake security-audit workflow to 346 GitHub repositories on October 8. Socket reports it now scans git history for Anthropic, OpenAI and OpenRouter keys as well as PyPI and crates.io publishing credentials.

  4. HIGH

    Vulnerability · Zenity Labs

    AgentCorruption: one prompt takes over Bedrock AgentCore agents

    AgentCorruption is a chain Zenity Labs demonstrated against Amazon Bedrock AgentCore, where one prompt to an exposed agent yields IAM credentials and then control of every AgentCore agent in the same AWS account and region.

  5. HIGH

    Supply chain · Socket

    TensorLake npm SDK published a credential stealer in 0.5.144

    tensorlake 0.5.144 on npm carried a credential-stealing worm that runs from a preinstall hook, Socket reports. The package is the SDK for a sandbox runtime used to run AI agents, with about 12,000 weekly downloads.

  6. MED

    Vulnerability · Splunk · CVE-2026-76286 · CVSS 5.3

    Splunk MCP Server: a custom tool's URL could capture a user's token

    Splunk MCP Server below 1.2.1 could send the Splunk platform authentication token of whoever ran a custom API tool to the URL configured for that tool. Splunk fixed it in 1.2.1 and rates the issue 5.3, medium.

  7. INFO

    Incident · SOCRadar

    CyberXero: an access broker ran 51 Claude Code agents against Ukraine

    CyberXero is a Russian-speaking initial access broker driving 51 specialized Claude Code agents. SOCRadar found its exposed working directory and confirmed theft of over 628,000 records from four Ukrainian organizations.

  8. MED

    Vulnerability · Grafana Labs · CVE-2026-89039 · CVSS 6.5

    mcp-k6: a Grafana MCP prompt returned any file the server could read

    CVE-2026-89039 is an arbitrary file read in mcp-k6, Grafana's experimental k6 MCP server, where the convert_playwright_script prompt returned the contents of any file the server's user could read. Grafana fixed it in 0.7.0.

  9. HIGH

    Vulnerability · Model Context Protocol · CVE-2026-104850 · CVSS 7.5

    MCP TypeScript SDK: OAuth client could leak credentials to servers

    CVE-2026-104850 in the MCP TypeScript SDK let a malicious MCP server pick the authorization server that receives a client's OAuth refresh tokens and client secrets. Fixed in @modelcontextprotocol/sdk 1.31.0 and client 2.2.0.

  10. HIGH

    Supply chain · Socket

    MemTensor MemOS packages compromised with a credential stealer

    Malicious releases of MemTensor's MemOS packages on npm and PyPI shipped sckit, a Go credential stealer that runs on import and sends npm, PyPI, GitHub, cloud and SSH secrets to skyleen[.]fr. Safe versions: npm 0.1.20, PyPI 2.0.33.

  11. INFO

    Incident · Google Threat Intelligence Group

    Google GTIG: attackers used AI agents to run a credential campaign

    Google Threat Intelligence Group reports a threat actor who planned, built and ran an agent-enabled mass credential harvesting campaign in under six hours. GTIG says it has not yet seen fully autonomous attack pipelines in the wild.