The credential an agent inherits sets the ceiling on the damage

GitGuardian's argument is that the manipulation decides whether an incident starts and the credentials decide how far it goes ^[1]. Of the three disclosures it cites, only one involved steering a model. CVE-2026-21852 works because a repository can set an environment variable: Claude Code reads ANTHROPIC_BASE_URL, then sends its API requests, key attached, to whatever host that variable names, and it does so before showing the user a trust prompt ^[6]. CVE-2026-12957 works because the Amazon Q extension for VS Code loaded .amazonq/mcp.json out of any workspace a developer opened, with no consent step and no workspace trust check ^[9]. Both needed a developer to open a folder.

The severity scores went elsewhere. Check Point's two remote code execution bugs in Claude Code, both reachable through repository configuration files loaded when the tool starts inside an untrusted project, scored higher than the key leak ^[5][8]. The stolen key is what outlives the patch: authenticated traffic to attacker infrastructure, usage billed to the victim, and access that persists wherever the key stays valid ^[8]. In the Amazon Q case, the attacker-controlled MCP process picked up live AWS credentials from the developer's environment, including the access key, the secret and active session tokens ^[10]. Wiz's proof of concept called aws sts get-caller-identity to establish which account and role those credentials belonged to, then sent the answer to an external server ^[11].

GitLost is the one case where the model itself was steered. Noma Labs filed a plausible-looking issue in a public repository containing instructions to retrieve information from other repositories in the organisation, and after testing variations of the prompt found that adding one word, "Additionally," was enough to get past GitHub's guardrails ^[2][3]. What followed was bounded by the agent's authority: read a private repository's README, post the contents as a public comment ^[4].

The published fixes went to the loaders. Anthropic patched its three issues between August and December 2025, ahead of Check Point's February 2026 disclosure ^[7]. Amazon fixed the consent flow in language server version 1.65.0 ^[12]. Neither patch changed the scope of the credentials the agent holds.

GitGuardian counted 28.6 million new hardcoded secrets on public GitHub in 2025, up 34 percent, and 24,008 of them sat in MCP configuration files ^[13][14]. That is 0.084 percent of the year's total ^[16]. The Shai-Hulud 2 breach alone accounted for 33,185, about 1.4 times every MCP config file combined ^[14][17].

For the scope argument to buy anything in your environment, the agent's process has to stop inheriting the shell it starts in. That means workspace-scoped, short-lived credentials minted for the tool call, so that get-caller-identity returns a role with no production reach. GitGuardian's own prescription is its product line: block secrets at the model and tool boundary, discover exposed credentials on developer endpoints, and shorten revocation ^[15]. Revocation time matters for the reason the Claude Code case shows, because a redirected API key keeps billing the victim for as long as it stays valid ^[8].