Topic starter
24/06/2026 7:11 pm
TL;DR: AI desktop assistants and coding tools often store OAuth tokens, API keys, and MCP credentials in plaintext JSON at predictable locations, creating easy theft paths through malware, WSL exposure, extension abuse, and session hijacking, according to Netwrix. The core issue is not just exposure, but trust assumptions that let one readable file or session inherit far more access than governance teams expect.
Editorial analysis by NHI Mgmt Group, based on content published by Netwrix: “Your AI coding assistant is leaking secrets”.
Key questions
Q: What breaks when AI coding assistants store secrets in predictable local files?
A: Predictable file paths turn credential storage into a discoverable attack surface.
A: Plaintext administrator credentials collapse the boundary between initial access and full environment control.
Q: What are the signs that AI assistant secret storage is misconfigured?
A: Look for inline tokens in JSON, synced extension settings, world-readable files in WSL, and any assistant profile that stores multiple service credentials together.
Practitioner guidance
- Audit assistant credential paths Inventory every AI desktop assistant, coding tool, and CLI that stores tokens in home-directory files, extension stores, or synced config paths.
- Replace plaintext token storage Move OAuth tokens, API keys, and MCP secrets out of plaintext JSON and into OS keychains or runtime credential helpers wherever the tool supports it.
- Reduce MCP credential aggregation Split multi-service MCP configs so one file does not carry GitHub, Slack, database, and cloud credentials together.
Bottom line: AI coding assistants are turning everyday developer workflows into secret distribution channels when tokens live in predictable local files and synced configs.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:22 am
Predictable secret paths create identity exposure, not just storage exposure. When credentials live in known JSON files, the security boundary shifts from authentication to file discovery. That means local OS permissions and sync behaviour become identity controls, which is a poor fit for secrets that can authenticate to multiple external services. The practitioner conclusion is that file location is part of the trust model.
A question worth separating out:
Q: Should organisations treat AI assistant credentials as NHI assets?
A: Yes. Assistant-stored tokens behave like non-human identities because they authenticate to external services, persist across sessions, and often outlive the user action that created them. Governance should cover inventory, scope, storage, rotation, and revocation, because the exposure pattern is identity-driven rather than purely endpoint-driven.
👉 Read our full editorial: AI coding assistants are leaking credentials across predictable file paths