CISA’s GitHub leak shows why MCP observability is now urgent

At a glance

What this is: This analysis argues that the CISA GitHub leak is a preview of the MCP security problem, where context-sensitive data can move through unsanctioned channels beyond legacy inspection points.

Why it matters: It matters because IAM, NHI, and AI governance teams need controls that can discover, inspect, and audit agent-connected data flows before machine-speed access turns a one-off leak into a repeatable pattern.

By the numbers:

• A contractor-maintained public GitHub repository exposed 844 MB of internal CISA and DHS material, including administrative credentials to three AWS GovCloud accounts.
• The exposed AWS keys remained valid for another 48 hours after takedown, extending the blast radius beyond the public exposure window.

👉 Read Nightfall's analysis of CISA's GitHub leak and MCP security risk

Context

MCP security is a governance problem before it is a protocol problem. When AI agents can reach source code, documents, and operational systems through developer-installed connectors, existing IAM and DLP models often miss the actual data path that matters.

The CISA leak shows how sensitive context moves through unsanctioned channels that sit outside traditional inspection points. That same pattern becomes more dangerous when agents, not people, can trigger tool calls at runtime across many systems at machine speed.

For teams responsible for NHI, agentic AI, and identity lifecycle governance, the lesson is not to treat every connected tool as benign. It is to assume that any connector with broad reach can become an access path for secrets, internal context, and audit blind spots.

Key questions

Q: What breaks when AI agents use MCP without stronger governance?

A: Governance breaks when the organisation assumes access happens through a stable, inspectable human workflow. MCP-connected agents can retrieve data and trigger tool calls across many systems in one session, so blind spots emerge in discovery, classification, and audit. If policy, logging, and inspection are not agent-aware, the organisation cannot prove what was accessed or why.

Q: Why do unsanctioned channels create such a large identity risk?

A: Unsanctioned channels bypass the controls that identity teams rely on to see requests, approvals, and data movement. When secrets or internal context move through personal repos, local sync tools, or developer-installed connectors, the organization loses the audit trail and the chance to enforce policy at the right point. That is why visibility matters as much as credential hygiene.

Q: How can organisations tell whether MCP access is actually being governed?

A: A governed MCP deployment can answer who requested access, what scope was granted, when the token expires, and which tool calls were made under that token. If logs only show a shared credential or generic server activity, the organisation does not have effective identity governance for the protocol.

Q: Who is accountable when a connector exposes sensitive corporate context?

A: Accountability sits with the organization that allowed the connector, the team that approved the data path, and the owners of the systems reached through it. In practice, that means IAM, security engineering, and platform owners all need a shared control model. If the path crosses personal infrastructure, accountability must be documented before an incident forces the issue.

Technical breakdown

Why unsanctioned channels defeat legacy DLP

Legacy DLP works best when sensitive data has a stable pattern, such as a credit card number or SSN. The CISA incident exposed a different class of content: infrastructure secrets, build code, internal docs, and operational context that are sensitive because of what they mean, not because of a fixed regex. If that material moves through a personal repo, personal device sync, or other off-platform path, the control plane never sees the event. Detection then depends on outside scanning rather than internal telemetry.

Practical implication: map where sensitive context can move without traversing a corporate inspection point.

How MCP expands the data path beyond the human user

MCP connects an LLM-driven client to external tools and data sources, often through local or developer-managed servers. That architecture makes the agent the broker of requests, but the connected systems still hold the data. The governance challenge is that the request, the response, and the downstream action can all sit inside a workflow that does not look like a classic human-initiated access event. Without protocol-level visibility, the organization cannot tell whether the human, the agent, or the connector drove the access.

Practical implication: treat every MCP server as an identity-bearing access path with its own controls and audit needs.

Why audit trails collapse when agent actions blend with human activity

Traditional logging often records that a user accessed a file or queried a system, but not whether an agent executed the request, which connector was used, or what content was returned. In the CISA case, mixed identity across corporate and personal accounts made accountability even harder. With AI agents, the same ambiguity becomes systemic because multiple tool calls can occur inside one session, across many sources, with no native separation between human intent and agent execution.

Practical implication: require agent-attributed logging that captures user, agent, connector, data class, and action.

Threat narrative

Attacker objective: The objective is to capture valid credentials and sensitive internal context that can be reused for unauthorized access, lateral movement, or further exfiltration.

1. Entry occurred through a public GitHub repository used to synchronize internal material outside corporate inspection controls.
2. Credential exposure followed when AWS keys, tokens, and other secrets were committed in plaintext and documented workarounds bypassed push protection.
3. Impact extended beyond disclosure because the exposed AWS keys remained valid after takedown, preserving access risk after public discovery.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Context-sensitive data is now the real access surface. The CISA leak was not just a secrets problem, it was a context problem. Infrastructure code, tokens, and internal docs were sensitive because they described how the organisation runs, and that kind of material rarely fits signature-based controls. The practical conclusion is that identity governance must treat unstructured corporate context as a governed asset, not just regulated data.

MCP observability is the control gap this incident previews. A developer-installed connector that can reach source code, cloud systems, and internal documents becomes an identity pathway whether or not the platform labels it as one. Continuous discovery, protocol-level inspection, and attributed audit logging are no longer nice-to-haves because the access path is distributed across tools, servers, and local clients. Practitioners should re-evaluate how many hidden access surfaces already sit outside their current IAM inventory.

Mixed identity patterns will become the default failure mode. The contractor’s use of both corporate and personal infrastructure shows how work context now crosses managed and unmanaged environments. That pattern collapses assumptions behind segmentation, because the organisation cannot assume the access path stays inside a single trust domain. Security teams need to account for the fact that identity now flows through a chain of devices, accounts, and connectors that are only partly under enterprise control.

Machine-speed execution changes the governance threshold. The article’s core warning is that the same pattern will be automated by AI agents running through MCP. When access requests, data retrieval, and tool calls happen in seconds rather than hours, human review cycles cannot act as the primary control boundary. The implication is not simply more monitoring, but a different governance model for runtime access and auditability across human, NHI, and agentic workflows.

Context governance is becoming the next NHI discipline. The best way to name this problem is context leak governance: the control question is not only who has a secret, but where sensitive operational context is allowed to travel. That is an NHI problem because secrets, tokens, service credentials, and agent connectors all participate in the same data path. Practitioners should align access governance with context flow, not just credential issuance.

From our research:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation, according to AI Agents: The New Attack Surface report.
• That is why OWASP Agentic Applications Top 10 belongs in the same conversation as NHI governance when AI agents can reach sensitive corporate systems.

What this signals

Context leak governance is becoming a separate control discipline from classic DLP. When source code, tokens, architecture notes, and operational docs can move through unsanctioned agent paths, teams need policy that understands business context, not just regulated data fields.

The immediate programme issue is coverage, not awareness. If your inventory does not include local connectors, developer-managed servers, and mixed personal-work flows, then your identity controls are already behind the actual access surface.

With 80% of organisations already reporting agent actions beyond intended scope, the next maturity step is to align identity review, audit logging, and connector discovery around runtime behaviour rather than static provisioning.

For practitioners

• Inventory all MCP-connected access paths Discover every MCP server, local connector, and developer-managed integration that can reach corporate systems. Include personal devices and non-corporate repos in the inventory because those are common blind spots for secret movement.
• Classify unstructured operational context Extend data classification beyond PII and PCI to include source code, build configs, cloud credentials, architecture docs, and M&A material. These are the artifacts that create breach impact even when no regex is present.
• Require agent-attributed audit logging Log the user, agent, connector, timestamp, data classification, and action for every tool call. Keep the record reconstructable for incident response, compliance review, and board reporting.
• Inspect tool calls at the protocol layer Place policy and content inspection on MCP requests and responses, not only on downstream storage. That is where attempted secret retrieval, poisoned content, or sensitive document access can be detected in time.
• Reassess trust in mixed personal and corporate workflows Review any workflow that synchronizes work data through personal infrastructure, personal accounts, or developer convenience tools. These paths often evade DLP and create unowned exposure windows.

Key takeaways

• The CISA leak shows that context-sensitive data, not just secrets, now defines the identity exposure surface.
• Machine-speed connectors make discovery, protocol inspection, and attributed logging the minimum viable control set for MCP governance.
• Teams that treat agent-connected data paths as governed identity surfaces will be better positioned to contain the next leak before it becomes systemic.

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Context-sensitive data: Context-sensitive data is information that becomes high risk because of what it reveals about the business, operations, or infrastructure. Source code, architecture notes, build configs, and cloud credentials often matter more than regulated fields because they expose how systems work and how to reach them.
• Agent-attributed audit logging: Agent-attributed audit logging records which user, agent, connector, and data class were involved in each action. For autonomous or semi-autonomous workflows, this is the difference between knowing that access happened and being able to prove how it happened.
• Unsanctioned channel: An unsanctioned channel is any path for data movement that bypasses enterprise inspection, approval, or monitoring controls. In NHI and agentic AI environments, these paths often include personal repos, local sync tools, and developer-installed connectors that move sensitive context outside governed surfaces.

What's in the full article

Nightfall's full analysis covers the operational detail this post intentionally leaves for the source:

• The repository timeline, including how the public exposure persisted for months before discovery.
• The specific sequence of alerts, escalation, and takedown that followed the third-party scan.
• The MCP observability model Nightfall outlines for discovery, inspection, and audit.
• The named incident comparisons Nightfall uses to connect this leak to AI-agent data risk.

👉 Nightfall's full post covers the leak timeline, MCP implications, and observability controls in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.