What is Agent Credential Theft?

AI agents need credentials to operate: API keys for external services, OAuth tokens for user accounts, database passwords for data access, and MCP server authentication tokens. These credentials are high-value targets because they grant the same access the agent has — often broad and privileged.

Theft vectors in the MCP ecosystem include tool poisoning (tool descriptions that instruct the agent to include credentials in parameters), prompt leaking (extracting credentials embedded in system prompts), malicious servers (logging authentication headers), and environment variable access (tools that can read the agent's runtime environment).

Stolen agent credentials are particularly dangerous because they're often long-lived and over-privileged. Agent API keys tend to be persistent (not session-scoped), have broad permissions (agents need to do many things), and are shared across sessions (the same key is reused). An attacker with these credentials can impersonate the agent indefinitely.

The blast radius extends beyond the agent itself. Agent credentials often grant access to production systems, customer data, financial services, and internal infrastructure. A single stolen API key can compromise an entire organisation's data and services.

Intercept reduces credential theft risk by acting as the authentication boundary. Credentials are configured in Intercept's server-side configuration, not passed through tool call parameters where they could be intercepted. Argument validation policies detect and block parameters containing credential-like patterns (API key formats, bearer tokens). The audit trail flags any tool call that attempts to access environment variables or file paths commonly used for credential storage.