The Hidden Attack Surface of Agentic AI: Securing AI Agent Integration Platforms

As AI is widely adopted, the number of integrated tools and services is growing rapidly. As they grow, the AI integration layer has become a new, and increasingly complex, attack surface. Each new component introduces additional credentials, secrets, and trust relationships. As onboarding AI becomes easier, organizations need to better understand these risks. Unfortunately, most security teams have not mapped their AI integration layer.

Cyera researchers examined that layer across hundreds of organizations and found thousands of exposed credentials: API keys for Composio, Arcade, Nango, Tavily, Exa, LlamaIndex, Firecrawl, and other platforms that connect AI models to the enterprise systems they operate on. The owners were startup founders, CTOs, AI company executives, and enterprise software vendors across North America, Europe, Africa, and APAC. In several cases, the credentials belonged to the people responsible for building the AI systems they compromised.

One example: a VP of Engineering at a North American technology company committed a Composio API key to a public repository. Composio is an AI agent integration platform that provides a unified interface for connecting LLMs and autonomous agents to hundreds of third-party applications, APIs, and enterprise tools with managed authentication and action execution. Depending on the permissions associated, an attacker with such a key can gain almost full visibility into the organization's AI agent ecosystem and possibly the ability to execute downstream tools.

What the AI Integration Layer Actually Does

The AI stack has a gap between the model and the systems it needs to reach. An agent tasked to "find all Salesforce customers who opened support tickets last week, summarize the issues, and notify account managers in Slack" needs to authenticate to Salesforce, manage OAuth tokens, refresh expired credentials, connect to Slack, and execute actions across both applications. The integration layer handles that work.

‍

‍

Four categories of platform make up this layer:

Integration Infrastructure.  Platforms like Nango build and maintain hundreds of integrations to Salesforce, Slack, GitHub, and Google Workspace, handling API authentication, connectors, and OAuth workflows. They manage hundreds of APIs and authentication flows behind a single interface.

Unified Enterprise Data Layers.  Platforms like Merge unify vendors within a category. Dozens of HR software vendors, Workday, BambooHR, ADP, HiBob, each expose different APIs. Merge abstracts those differences so AI agents query HR data without maintaining separate integrations for each vendor.

AI-Native Search and Retrieval.  Platforms like Composio, Arcade, and Nango give AI agents search and retrieval capabilities: real-time web search, content extraction, and structured data retrieval. They are the primary mechanism through which agents gather external information and feed it into knowledge pipelines.

Agent Security and Governance.  Platforms like Arcade define what AI agents are permitted to do: delete records, access customer data, send emails, approve transactions, modify cloud resources, and so on. They broker authentication between agents and the services they operate on.

What Cyera Found

Cyera researchers identified its customers' AI integration infrastructure across hundreds of organizations. MCP servers represented the largest category by count. Across all categories, we observed tenants running thousands of sanctioned and unsanctioned applications. More than 10% of those applications were both unsanctioned and externally facing. Upon detection, our customers were alerted to mitigate and better secure their environments.

MCP Servers: Large Footprint, Low Visibility

MCP servers were the most prevalent category, with hundreds of tenants and thousands of deployments including Microsoft 365 MCP, Atlassian, and Notion integrations. Discovering an MCP server provides almost no information about its actual risk. A single MCP server can expose source code, internal documentation, cloud environments, customer data, or proprietary business systems. Knowing the server exists does not reveal what data it can access, what actions it can perform, or what an attacker gains by compromising it.

Agent Authentication and Governance

Cyera found dozens of organizations running platforms like Arcade and Composio, including 17 unsanctioned deployments. These platforms act as authentication brokers for AI agents, managing access to external services and APIs. Designed to centralize security decisions, they often become the most privileged single points in the agent stack, a single integration granting access to dozens of downstream applications.

AI Search and Retrieval

Platforms like Tavily, Exa, and Firecrawl appeared in multiple environments. These services give agents their view of the external world: what information they retrieve, from where, and what enters their knowledge pipelines. Organizations do not track this. An agent retrieving information through a compromised search layer makes decisions based on manipulated data with no audit trail.

Unified Integration Platforms

Cyera found deployments of Merge, Nango, and Apideck with dozens of registered integrations each. These platforms aggregate access to multiple SaaS applications behind a single interface. One Nango deployment connects CRM platforms, HR systems, finance applications, ticketing tools, and source code repositories. One compromised credential reaches all of them.

The Gap Inventory Alone Cannot Close

An MCP server connected to a public knowledge base and one connected to production cloud environments appear identical in an asset inventory. They carry entirely different risk profiles. Organizations need to understand what each integration can access, what permissions agents hold through it, and what an attacker gains by compromising it.

Credentials Exposed in the Wild

Cyera researchers discovered hundreds of publicly accessible files containing sensitive AI infrastructure credentials. Among the exposed secrets were dozens of API keys for Composio, Nango, Tavily, Exa, Arcade, LlamaIndex, and numerous other AI integration platforms.

The affected organizations and individuals represented a diverse cross-section of the AI ecosystem, including AI application developers, OpenClaw-related projects, academic institutions, startup founders, engineering leaders, AI company executives, enterprise software vendors, and financial services firms.

What These Leaked Credentials Actually Unlock

While each key provides different levels of access, permissions, and execution capabilities, they can generally be grouped into two main categories. 

The first (and most critical) category includes Agent Authentication & Governance and Unified API & Integration platforms. These are particularly sensitive because they often allow whoever controls the key to inventory the environment, enumerate connected tools and integrations, execute actions, and in some cases act as a proxy for invoking commands across connected services.

The impact ultimately depends on the permissions granted to the key and the systems connected through it. In practice, these keys frequently have broad privileges and are integrated with numerous applications across critical parts of the AI stack. As a result, a compromised key may provide an attacker with visibility into the organization's AI infrastructure, access to connected services and data sources, and, in some cases, the ability to interact with internal systems, applications, and databases through trusted agent workflows.

The second category - AI Search & Retrieval - is less critical since most of the keys only enable external internet search. However, they still allow an attacker to consume resources. 

The MCP server category (in our table above) is the wildcard in the equation. Organizations often inventory these AI stack components under the generic label “MCP server”, making it difficult to determine their true capabilities and, consequently, the full blast radius of a compromise. An MCP server can be connected to anything from internal databases and ticketing systems to source code repositories, cloud environments, SaaS applications, and proprietary business systems. Without a clear understanding of what each MCP server is connected to and authorized to access, assessing the impact of an exposed credential or compromised agent becomes significantly more challenging.

Below are some further examples to exposed API keys:

Arcade: The Full Agent Action Surface

According to their documentation, an Arcade API key unlocks everything Arcade can reach. Arcade brokers authentication between AI agents and the external services they operate on: productivity suites, communication platforms, ticketing systems, CRM environments, cloud services, and development platforms. An attacker with a compromised key inherits the same action surface available to the agent: reading data, modifying records, creating resources, sending communications, triggering workflows.

In agent frameworks, Arcade controls agent actions, not just data reads. The blast radius is bounded by the permissions the organization delegated to the agents operating through it.

Nango: One Credential, the Entire Integration Stack

According to their documentation, a compromised Nango credential exposes the organization's entire integration fabric. Nango manages OAuth flows, token refreshes, and API connections across hundreds of SaaS integrations. One deployment connects CRM platforms, ticketing systems, collaboration tools, source code repositories, HR systems, and financial platforms through a single interface.

In agentic environments, Nango is the bridge between AI agents and those systems, enabling data retrieval, synchronization, and action execution across the organization's application stack. One credential reaches all of it. 

A Closer Look at the Exposed Composio API Key

Composio is an integration layer that lets AI agents act in the real world. It makes the life of developers easy by connecting many apps at once. An easy to use platform and AI-based chat make the work even easier. Composio exposes 1,043 integrations and over 23,000 actions across Gmail, GitHub, Slack, Notion, CircleCI, databases, and more. 

When we started working with Composio we configured our API key. The default is “No access”, as illustrated below. You can define Read Only, Write only, or Full access.

We defined a test key to which we gave a full access privilege. 

Next we started adding tools. We used the AI chat setup which enables absolutely easy and frictionless onboarding.

You can see how a non-expert can have an agent reading email and pushing code in minutes. 

To illustrate the permissions we tricked the Composio integration a bit and defined our Gmail account as a child account.

This screenshot illustrates a fake user giving very permissive access to the Composio integration.

The trade-off is that the Composio key now has access to the fake user’s email. We added GitHub and CircleCI just to check what can happen if the fake user’s key leaked.

One plausible scenario,seen thousands of times in the past, involves an API key committed to a repository, which is subsequently baked into a container image, printed in a CI log, or pulled via SSRF. 

We tested everything in our own lab, generating several GET requests to Composio. This simulated an external threat actor who had found our key, enabling them to retrieve the underlying credentials. A single read-only call returned the Gmail access_token and refresh_token, the GitHub bearer token, and the CircleCI API key. 

When inspecting the Composio APIs, one in particular stands out. 

The Sandbox Execute provides a remote, persistent execution environment where AI agents can run Python code, execute shell commands, process files, make API requests, and interact with Composio-connected tools within an isolated workspace. While it is labeled as a remote command execution, effectively it is running in a Composio sandbox and probably guarded with proper guardrails and protections. Other than successfully executing a command with our API key, we didn’t further test this API.

Proxy Execute allows Composio to act as an authenticated proxy to third-party services, enabling users or agents to make arbitrary API requests to connected applications. In our case Gmail, GitHub and CircleCI. We fetched the last 10 emails with a “leaked” API key and got the results.

The blast radius is the union of every connected scope, and here the scopes were wide: Gmail granted https://mail.google.com/ (full mailbox — read, send, delete), GitHub carried repo + workflow (private source and CI control), and CircleCI's key exposed pipeline environment variables where cloud and deploy secrets live.

From there the pivots write themselves: mine the inbox for password-reset emails to take over other accounts, exfiltrate private sources and plant a backdoor in GitHub Actions, harvest infrastructure credentials from CircleCI. 

Worse, because the raw tokens are now in the attacker's hands, rotating the Composio key doesn't end the incident. The refresh tokens keep working directly against Google, GitHub, and CircleCI until each downstream grant is individually revoked. 

What Organizations Should Do

Build the inventory

Security teams cannot govern AI integration infrastructure they have not found. A continuously updated inventory of MCP servers, agent governance platforms, retrieval services, and integration providers is the starting point. That inventory must include unsanctioned deployments, externally facing applications, and shadow AI infrastructure that entered without security review.

Understand the exposure

An inventory tells you what exists. Governance tells you what each integration can reach. Security teams need to map what data each integration accesses, what permissions agents hold through it, what business systems are reachable, and what the blast radius of a compromise would be. Asset discovery is where governance starts.

Enforce controls 

Discovery and understanding without enforcement leaves risk documented but unaddressed. Security teams need the ability to act on sensitive data access, excessive permissions, exposed secrets, unsanctioned applications, and risky integrations, catching them before they become entry points. At Cyera, this is the work we do across the AI integration layer: discover what exists, understand what it exposes, and enforce controls that reduce risk.

Your security team has an inventory of cloud accounts, endpoints, and SaaS applications. How many of the 1,344 AI integration apps Cyera found across similar organizations appear in yours? How many of those are unsanctioned? Or connected to the internet? Answering those questions is essential to assessing your AI risk. To see how Cyera can help, book a demo at Cyera.com.