AI Coding Agents Are Leaking Credentials: Cursor, Claude Code, Copilot, and MCP

Automated excerpt

The hidden trail: Cursor, Claude Code, and GitHub Copilot store credentials across config files, env variables, logs, shell history, and temp files that repository and CI scanners never inspect. The evidence: GitGuardian's State of Secrets Sprawl 2026 found 24,008 unique secrets in public MCP configuration files, 2,117 of them valid, plus a 3. 2% leak rate in Claude Code-assisted commits. When credentials are written inline, the MCP configuration files of all three tools become plaintext credential stores.

Selected automatically from source text; not independently written or fact-checked. Read the original for full context.