Exposed Agent Keys Can Become a Route into Infrastructure: What Leaked AI and MCP Credentials Actually Expose

Flare's analysis of 12,446 de-duplicated records found at least 438 distinct AI-related credentials (315 LLM-provider keys and 122 downstream secrets) circulating in infostealer logs and other channels; most dated keys trace to source logs under 30 days old, indicating a live, replenishing supply. The report shows MCP configuration files often name the services and environment variables an agent uses—acting as a wiring diagram—so when combined with commodity stealers that collect host environments, a single host compromise yields targeted access to databases, cloud keys, source-control tokens, and payment keys. Key recommendations include rotating keys on cadence or compromise, treating MCP configs as sensitive, prioritizing hunts on recent logs, and discounting bulk credential-checker feeds when sizing exposure.