The concentration point is where the blast radius sits. A tool server brokering access to a dozen systems holds every scope those systems granted it, so one compromise inherits all of them [5], and the secrets doing the authenticating live in configuration files and never rotate [2]. Token passthrough compounds that: an MCP server forwards a bearer token upstream without checking who it belongs to [3], so the upstream system audits the server instead of the caller. A shared client identity gives the mirror case, where one caller inherits permissions meant for another [4]. All three regressions the commentary names sit in the identity and cryptography layer rather than the model layer [19].
The PKI comparison is the strongest part of the argument. If a PKI can automate 47-day certificates, the piece says, it can issue 15-minute agent credentials [16]. In operational terms, 47 days is 67,680 minutes, so a 15-minute credential means 4,512 issuances per certificate lifetime [17]. That is an issuance-volume and revocation-plumbing problem before it is a policy problem. The schedule driving the certificate side is a 153-day cut, from 200 days to 47, a 76.5 percent reduction across the period [18].
On the artifact side the failure is enforcement rather than availability. Loading a model in the common PyTorch serialization format runs code, because pickle executes during deserialization [6]. ReversingLabs documented in February 2025 how thin the hub-side check is: malicious models using non-standard compression and deliberately broken pickle files got past a public model hub's scanner, and the payload opened a reverse shell [7]. Signing infrastructure shipped. OpenSSF published its Model Signing specification in 2025, with detached signatures, Sigstore-style identity-bound signing and a public transparency log [8], and NVIDIA signs models published through NGC while Google does the same on Kaggle [9]. What remains rare is a gate that refuses to load an unsigned artifact [10].
The prevalence claim deserves a closer look. This is a commentary, and the specific incidents in it are documented elsewhere, but the assertion that connectors are "frequently" configured with static keys and long-lived tokens comes with no survey or count [21]. The direction is sourced, though the share of estates already in this state is not.
The underlying reason the fix is awkward is that an agent acts on a person's behalf, with that person's authority, at machine speed, and picks its tools at runtime, while identity models assume either a human at a keyboard or a workload with a fixed declared purpose [14]. That is the gap OWASP labels excessive agency at LLM06, where delegation without scoping turns one compromised prompt into an exfiltration path [13]. The same asymmetry applies to secrets in context: a key pasted into a prompt lands in request logs, traces, evaluation datasets, caches, and sometimes an embedding that outlives the conversation by years [11], which is why OWASP lists sensitive information disclosure at LLM02 and vector and embedding weaknesses at LLM08 [12]. The 200-day certificate deadline arrives in March 2026 [1]. The automation built to meet it is the same automation an agent credential needs.
