Over half of MCP servers rely on static API keys, Astrix finds

The article describes a shift in how developers connect AI agents to services. Previously, a single developer could hold one credential for one service and manage that secret themselves. Now, AI agents often access tools, data sources, and APIs through a growing number of credentials that are not clearly owned by any one person.

The body cites two pieces of evidence that illustrate the problem. GitGuardian reported a roughly eightfold increase in leaked authentication credentials for AI-related services over the past year. Separately, Astrix Research examined 5,200 MCP servers and found that 53 percent relied on static credentials and that 79 percent of API keys were read from environment variables. The article notes these practices were designed under the assumption that a human controls the secret and its scope, which no longer holds when an agent reads those credentials automatically.

The stakes hinge on whether organizations can replace static secrets with stronger mechanisms like OAuth before attacks become widespread. The body describes tool poisoning as emerging, and cites a report of a supply chain attack in February 2026 where attackers registered a fake MCP server as a legitimate listing. For security teams, the outcome likely depends on whether the industry adopts more secure authentication before more agents are deployed with broad access.