AI Agent Security Is Worse Than You Think: Inside the 15% Credential Leak Crisis

AI agents are everywhere in 2026. Every startup has one, every enterprise is piloting one, and every developer is building one. The infrastructure to support them — frameworks, registries, skill marketplaces — has grown at a pace that outstrips the security thinking behind them.

In May, Capsule Security published a report that should have gotten more attention than it did: 15% of AI agent skill files in popular registries contain hardcoded credentials, and many of those credentials grant database write access.

Let that sink in. In an ecosystem that is actively being deployed into production environments at Fortune 500 companies, one in six publicly available skill files has passwords, API keys, or tokens sitting in plain text — credentials that can modify or destroy data.

How Did We Get Here?

The root cause is a collision between two forces: the push for rapid agent deployment and the design of agent skill files themselves.

Skill files (typically skills.md) are meant to teach an AI model how to use a tool. They describe what the tool does, what parameters it accepts, and how to call it. They are essentially documentation — but documentation that the agent reads and acts on directly.

The problem is in the examples. To make a skill file “executable” — so the agent can actually demonstrate it works — developers paste working examples. And working examples need real credentials. So API keys, database connection strings, and JWT tokens end up in files that get uploaded to public registries.

This is not a theoretical vulnerability. These files are being downloaded and executed by agents in production environments right now.

The Attack Surface Keeps Growing

The credential leak is just the most visible symptom. The broader AI agent security landscape has several concerning dimensions.

The Trust Model for Skill Registries Has Collapsed

There are thousands of skills.md files on GitHub and various agent registries. Anyone can upload. Anyone can download. There is no vetting process, no security review, no signature verification.

When your agent loads a skill file from an unknown source, you are essentially granting that source permission to define how your agent behaves. A malicious skill file could:

• Redirect API calls to attacker-controlled endpoints
• Exfiltrate data through seemingly innocent tool parameters
• Execute arbitrary commands via embedded shell examples
• Introduce prompt injection payloads that manipulate agent behavior

One researcher analyzed over 4,000 skill repositories and found not just credential leaks but evidence of skill file tampering — files that had been modified after their initial publication to include malicious payloads.

OWASP Agentic AI Top 10 Is Not Academic

OWASP’s Agentic AI Top 10, released in 2026, is built from real incidents. The four most relevant to the current crisis:

Prompt Injection — Since agents are driven by LLMs and LLMs process natural language, attackers can embed malicious instructions in data sources that agents read. Unlike SQL injection, you cannot simply sanitize natural language input. Every piece of text an agent consumes is a potential attack vector.

Excessive Agency — Agents routinely receive more permissions than they need. An agent designed to read log files might get full filesystem access. When that agent is compromised through prompt injection, the attacker inherits all those permissions.

Unsafe Tool Execution — The tools that agents invoke (MCP servers, API endpoints, command-line utilities) often lack proper sandboxing. A manipulated agent can execute arbitrary commands on the host machine, which may be connected to production infrastructure.

Training Data and Context Leakage — Agents accumulate context as they work. That context may contain user PII, corporate secrets, or other sensitive data. If context windows are not properly isolated or encrypted between sessions, they become a new leakage channel.

Where the Frameworks Stand

The major agent frameworks take different approaches to security:

LangGraph leads in security features. Its durable execution model with checkpointing means every agent action can be audited and rolled back. Over 400 enterprises use it in production, which has driven continuous security improvements. The checkpointing mechanism alone is valuable — if an agent goes rogue, you can revert to the last known-good state.

Claude Agent SDK provides 18 lifecycle hooks that let developers insert security checks at various points during agent execution. Native MCP support gives a standardized interface for tool-level access control. The trade-off is vendor lock-in — you are tied to Anthropic’s ecosystem.

OpenAI Agents SDK supports 100+ models and has built-in tracing. Its typed handoff mechanism passes metadata between agents, which helps build audit trails. But its fine-grained permission controls lag behind LangGraph.

CrewAI is designed for speed. You can build a working multi-agent team in about 35 lines of code. But that speed comes at a security cost — default configurations are permissive, and developers need to harden them manually.

Microsoft Agent Framework has the most comprehensive OWASP Agentic Top 10 coverage and dual-language support (.NET and Python). But its ecosystem is smaller, with fewer third-party tools and skill files available.

What Enterprises Should Actually Do

If you are deploying AI agents in production, here is the practical checklist:

Implement least privilege. An agent should have the minimum permissions needed to complete its task. Read-only if it only needs to read. Table-specific access if it only needs one table. No “just in case” admin permissions.

Audit every third-party skill file. Before integrating any skill file from an external source, review it for hardcoded credentials, suspicious URLs pointing to external servers, and overly broad permission declarations. Treat skill files the same way you would treat any third-party dependency.

Sandbox agent execution. Containerize, virtualize, or use OS-level isolation for agent runtime environments. If an agent is compromised, the damage should be contained to the sandbox, not spread to production systems.

Enable audit logging. Record every decision an agent makes and every action it takes. This is not just for post-incident forensics — it is for establishing behavioral baselines so you can detect when an agent starts acting outside its normal patterns.

Rotate credentials regularly. Even if you use a secrets manager, rotate your credentials on a schedule. Many of the leaked credentials in Capsule Security’s report had been sitting in skill files for months or years. Regular rotation limits the damage window.

What Comes Next

AI agent security is not a problem you solve once and move on. As agents get more capable and get granted more authority, the consequences of a breach grow proportionally.

Over the next 6 to 12 months, expect:

• More agent-specific security tooling, especially automated scanners for skill file credential detection
• Cloud providers launching identity and access management solutions designed specifically for AI agents
• Industry bodies pushing for mandatory AI agent security compliance standards
• Insurance companies offering specialized coverage for AI agent security incidents

These developments are all positive. But enterprises should not wait for standards to mature before taking action. AI agent security needs to be part of your existing security posture today — because attackers are not waiting for the standards to be written.

Security is not a feature. It is a continuous state. In the age of autonomous agents, that matters more than ever.