MCP Security Gaps: Agent Traffic Evades Network Detection While Public Configs Expose Credentials

Two September 2026 analyses show Model Context Protocol deployments outpacing security controls: MCP agent traffic evaded Suricata and RITA detection by mimicking C2 beaconing in testbeds, and Hush Security found 12% of ~82,000 public GitHub MCP config files…

Model Context Protocol (MCP) adoption is exposing security gaps on two fronts, per reports published two days apart in September 2026. Network detection: An arXiv study (2026-09-16, cs.CR) demonstrates that MCP JSON-RPC traffic over Streamable HTTP structurally mimics the polling cadence of C2 frameworks such as Cobalt Strike. In a Docker testbed using eleven traffic profiles across three TLS conditions (cleartext, TLS-inspected, and opaque), Suricata with the Emerging Threats Open ruleset produced near-zero alerts, and RITA assigned a consistent 0.0 beacon score regardless of jitter or TLS inspection. The authors propose an agent-native network indication standard based on Agent-Native ALPN and standardized out-of-band headers. Credential exposure: Hush Security's report "The State of MCP Configuration: The Identity Security Gaps" (covered by Help Net Security, 2026-09-18) analyzed roughly 82,000 MCP configuration files in public GitHub repositories, finding 12% of credential slots contained hardcoded literals — predominantly vendor API keys, bearer tokens, and database passwords — identified using provider-specific token patterns and Shannon entropy. Of 7,681 credential-bearing configurations whose history was examined, 243 had secrets removed from the current file but still recoverable from earlier Git commits. The report's summary states 53% of classified credentials granted organization-, account-, workspace-, or database-wide access and 80% of secrets with a defined expiration policy did not expire by default; its bullet points additionally give a combined figure of 24% of hardcoded secrets being broad-scope and non-expiring by design. It also notes 55% of secrets had no vendor-recognizable token format, hindering detection, and frames MCP agents as non-human identities requiring ownership and lifecycle tracking.

• arXiv study (2026-09-16): MCP JSON-RPC traffic over Streamable HTTP structurally resembles C2 beaconing cadence used by APT tooling such as Cobalt Strike
• Testbed: Docker, eleven traffic profiles, three TLS conditions (cleartext, TLS-inspected, opaque); results consistent across all conditions
• Suricata with the Emerging Threats Open ruleset produced near-zero alerts on MCP traffic; RITA assigned a consistent 0.0 beacon score regardless of jitter or TLS inspection
• Authors propose Agent-Native ALPN and standardized out-of-band headers as an agent-native network indication standard
• Hush Security analyzed ~82,000 MCP configuration files in public GitHub repositories (reported by Help Net Security, 2026-09-18)
• 12% of credential slots contained hardcoded credential literals: predominantly vendor API keys, bearer tokens, and database passwords
• Detection used provider-specific token patterns and Shannon entropy; 55% of secrets had no vendor-recognizable token format
• 243 of 7,681 credential-bearing configs had secrets removed from current files but still recoverable from earlier Git commits