Credential and Secret Exposure in Agent Output
This detects when an AI agent's output contains actual secrets — API keys, private keys, database connection strings, tokens — instead of just discussing them. If an agent has access to credentials somewhere in its context or tools, it can end up printing them back to a user or into a log.
How the attack works
An AI agent has access to credentials, either through its system prompt, connected tools, retrieved documents, or environment configuration. During normal operation or in response to a crafted prompt, the agent includes one of these secrets verbatim in its reply. The rule matches known formats for cloud provider keys, CI/CD tokens, payment processor keys, SSH private keys, JWTs, .env-style variable assignments, and generic secret patterns. Anyone reading the agent's output — a user, a log, a chat transcript — now has a working credential.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- e69fe2b0-35ef-4757-8437-54f70aed08b3
- Severity
- Critical
- CVEs
- CVE-2025-32711
Why it matters
A leaked credential can be used directly for unauthorized access, lateral movement into other systems, or financial loss, without the attacker needing to breach anything else first.
What you can do
- →Never place live credentials in an agent's system prompt, context window, or tool configuration if it can be avoided; use short-lived scoped tokens instead.
- →Route agent output through a secret-scanning filter before it reaches users or logs.
- →Rotate any credential that appears in agent output immediately, treating it as compromised.
- →Review what tools and data sources the agent can access, and remove any that expose secrets unnecessarily.
Known benign look-alikes
- Agent discussing API key formats in educational context without real keys
- Redacted or placeholder keys such as sk-xxxxxxxxxxxx or AKIA_EXAMPLE
- Documentation examples using clearly fake credentials
- Connection string templates with placeholder values