Notifications
Clear all
Topic starter
17/08/2026 5:40 pm
TL;DR: A supply chain attack against Claude Code can silently rewrite local MCP routing to intercept OAuth bearer tokens for Jira, Confluence and GitHub before they reach the intended service, according to Unosecur. The incident shows that persistent, broadly scoped MCP credentials create an identity governance gap that traditional IAM inventories and provider logs will miss.
NHIMG editorial — based on content published by Unosecur: Claude Code's MCP Traffic Can Be Silently Hijacked to Steal OAuth Tokens
By the numbers:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation.
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks.
Questions worth separating out
Q: How should security teams handle MCP-delegated OAuth tokens in developer tools?
A: Treat them as governed non-human identities, not as hidden configuration.
Q: Why do MCP integrations complicate enterprise access control?
A: MCP integrations complicate access control because they create many new tool connections that each need a clear identity, scope, and audit trail.
Q: What breaks when credential storage and endpoint routing share the same file?
A: A single local change can compromise both the token and the path it follows, so integrity and confidentiality fail together.
Practitioner guidance
- Inventory MCP-delegated credentials as governed NHIs Identify every Claude Code or similar MCP integration that stores bearer or refresh tokens locally, then add those credentials to the same inventory and review process used for other non-human identities.
- Separate routing state from token storage Move endpoint trust decisions out of plaintext local files where possible, and flag any configuration that lets the same write operation alter both mcpServers URLs and secret material.
- Detect configuration drift before token rotation Search for sessionStart hooks, localhost proxy rewrites and unexpected changes to trusted project paths before rotating any connected OAuth token, because rotation alone can refresh attacker access.
What's in the full article
Unosecur's full blog covers the operational detail this post intentionally leaves for the source:
- The exact ~/.claude.json fields that need to be checked on developer machines, including mcpServers and sessionStart hooks.
- The step-by-step remediation order for removing malicious hooks before rotating connected OAuth tokens.
- The provider-side log patterns and endpoint artefacts that help distinguish legitimate OAuth use from proxy-based interception.
- The product-specific controls Unosecur describes for governing MCP-delegated identities and per-agent scope.
👉 Read Unosecur’s analysis of Claude Code MCP traffic hijacking and OAuth token theft →
Claude Code MCP hijack: what this means for token governance?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 5:40 pm
Claude Code’s MCP token problem is an NHI governance problem, not a product bug. The article makes clear that the vulnerable asset is a delegated credential living outside IAM inventory, review, and lifecycle control. Once a token is both persistent and broadly scoped, the security issue becomes governance of the identity itself, not just the application that used it.
A few things that frame the scale:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation, according to The State of Secrets Sprawl 2026.
- Our research also found that 28% of secrets incidents now originate outside code repositories, in Slack, Jira and Confluence, and are 13% more likely to be critical than code-based leaks.
A question worth separating out:
Q: Who is accountable when a stolen MCP token is replayed through a trusted SaaS origin?
A: Accountability sits with the team that governed the delegation path, not just the SaaS provider. If the token was stored locally, never reviewed and never separated from routing controls, then the identity programme failed before the replay happened. Downstream logs may look clean, but governance still owns the exposure.
👉 Read our full editorial: Claude Code MCP traffic hijack exposes OAuth token governance gaps
