Bulk Environment Variable Harvesting and Exfiltration

How the attack works

An attacker gets an AI agent to run a command or write code that reads the entire environment in one go, using calls like printenv, process.env, or os.environ rather than a single named variable. The harvested data is then packaged and sent outbound using a network call such as curl, fetch, or another HTTP request. The rule flags this pattern whether both steps appear together or whether either step shows up on its own, since either can be part of the same exfiltration attempt. The goal is to collect secrets stored as environment variables and move them to a location the attacker controls.

Netzilo detection

Why it matters

If successful, an attacker obtains API keys, database credentials, and service tokens for every system the compromised environment touches, potentially enabling further compromise of connected services and accounts.

What you can do

• →Avoid storing long-lived secrets directly as environment variables; use a secrets manager with short-lived, scoped credentials instead.
• →Restrict outbound network access for agent execution environments so unexpected destinations cannot receive data.
• →Review any agent or tool code that reads the full environment at once instead of specific named variables.
• →Treat printenv, process.env, or os.environ calls followed by outbound HTTP calls as suspicious unless tied to known debugging or CI/CD workflows, and check that CI/CD debug output stays in logs rather than leaving the pipeline.

Known benign look-alikes

• Debugging tools that display environment info locally
• Application startup that loads .env for configuration
• CI/CD pipeline scripts that run printenv to debug build failures and pipe output to a log file

References

• https://agentthreatrule.org/en/rules/ATR-2026-00115

Related threats