Bare Key Elicitation Token Detection

How the attack works

An attacker, or a compromised system feeding messages to the AI, sends a chat turn that is only a bare secret label such as 'key:', '(key)', or its equivalent in Spanish, French, or German. Because the message looks like a prompt for a value rather than a question, some assistants respond by completing it — pulling a stored credential, API key, or password into their reply. The attacker then has a live secret handed to them in what looks like ordinary conversation. This works because the assistant may pattern-match the bare label to a 'fill in the blank' request instead of recognizing it as suspicious input.

Netzilo detection

Why it matters

If successful, this leaks live credentials or API keys directly through the chat interface, giving an attacker access to whatever those secrets protect without needing to breach any system directly.

What you can do

• →Configure AI assistants to never output raw secrets, keys, or passwords in chat responses regardless of how the request is phrased.
• →Review conversation logs for isolated messages that are only a secret label with no other content.
• →Restrict which credentials or secrets an AI assistant can access or reference in its context at all.
• →If agents pass messages between each other, validate and sanitize inter-agent messages the same way you would untrusted user input.

Known benign look-alikes

• Users asking a genuinely short question that happens to include the word 'key' as part of a larger sentence (not matched: pattern is whole-string anchored)
• Single-word UI field labels echoed back by legitimate form-fill automation in non-conversational contexts

References

• https://agentthreatrule.org/en/rules/ATR-2026-02007

Related threats