Bare Key Elicitation with Trailing Colon
This detects a prompt-injection trick where an attacker plants a bare label like 'SECRET_KEY:' or 'api_key=' with nothing after it, hoping the AI model will complete the pattern by filling in a real secret value. Instead of directly asking for credentials, the attacker relies on the model's tendency to complete unfinished text.
How the attack works
An attacker inserts text into a user message or into content that a tool fetches and feeds back to the model (like a webpage or file the model reads). That text contains a key/secret label followed by a colon, equals sign, or open bracket, but no value — for example 'SECRET_KEY:' with nothing after it. Because the model is trained to complete patterns and follow instructions, it may 'fill in' the blank with a real credential it has access to, such as an API key from its context or memory. This avoids more obvious phrasing like 'give me your API key,' which is more likely to trigger existing safeguards.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 03b0c6eb-3b35-45dd-8ef8-25fa6d96c3da
- Severity
- High
Why it matters
If successful, this leaks API keys, tokens, or other credentials the AI model has access to, handing an attacker working access to connected systems or services.
What you can do
- →Treat any external content fed into an AI agent (web pages, tool outputs, documents) as untrusted input, not as instructions to follow.
- →Never let an agent have direct access to live credentials it could echo back; use scoped, short-lived tokens brokered outside the model's context.
- →Review agent logs for outputs that contain complete key/secret values immediately following a dangling label pattern.
- →Add output filtering that blocks responses matching credential-like patterns (e.g., 'key:', 'token=') paired with real-looking values before they reach the user or a downstream tool.
Known benign look-alikes
- System-authored schema or config blocks that legitimately end a 'key:' line before a nested YAML/JSON value
- Documentation snippets showing config file syntax without real secrets