AI Weekly Malaysia

MCP servers, the middleware that lets AI agents connect to external tools and data, are becoming a major security blind spot by holding plaintext credentials, API tokens, and service account keys in configuration files. The article identifies three core exposure vectors: plaintext config files, over-permissioned access, and prompt injection—often before security teams even know the server is running. Because MCP turns AI agents into active identities with non-human credentials, a leaked secret grants attackers the ability to take action, not just read data.

Why: If you are building or deploying MCP servers for AI agents, you need to audit what secrets your MCP server configs hold and whether they are stored in plaintext—this is the concrete, immediate action the article demands. Over-permissioned NHIs (non-human identities) are the second thing to check: scope down API keys and tokens to least privilege. For Malaysian teams shipping AI agents into production, this is a practical checklist before connecting any MCP server to cloud infrastructure or internal databases.