# Credential and Secret Exposure in Agent Output

- **Severity:** Critical
- **Signature ID:** `e69fe2b0-35ef-4757-8437-54f70aed08b3`
- **CVEs:** CVE-2025-32711
- **MITRE ATLAS:** AML.T0055 (Unsecured Credentials), AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI03 (Identity and Impersonation), LLM02 (Sensitive Information Disclosure), LLM07 (System Prompt Leakage)

## Summary

This detects when an AI agent's output contains actual secrets — API keys, private keys, database connection strings, tokens — instead of just discussing them. If an agent has access to credentials somewhere in its context or tools, it can end up printing them back to a user or into a log.

## How the attack works

An AI agent has access to credentials, either through its system prompt, connected tools, retrieved documents, or environment configuration. During normal operation or in response to a crafted prompt, the agent includes one of these secrets verbatim in its reply. The rule matches known formats for cloud provider keys, CI/CD tokens, payment processor keys, SSH private keys, JWTs, .env-style variable assignments, and generic secret patterns. Anyone reading the agent's output — a user, a log, a chat transcript — now has a working credential.

## Why it matters

A leaked credential can be used directly for unauthorized access, lateral movement into other systems, or financial loss, without the attacker needing to breach anything else first.

## What you can do

- Never place live credentials in an agent's system prompt, context window, or tool configuration if it can be avoided; use short-lived scoped tokens instead.
- Route agent output through a secret-scanning filter before it reaches users or logs.
- Rotate any credential that appears in agent output immediately, treating it as compromised.
- Review what tools and data sources the agent can access, and remove any that expose secrets unnecessarily.

## Known benign look-alikes

- Agent discussing API key formats in educational context without real keys
- Redacted or placeholder keys such as sk-xxxxxxxxxxxx or AKIA_EXAMPLE
- Documentation examples using clearly fake credentials
- Connection string templates with placeholder values

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00021
- https://nvd.nist.gov/vuln/detail/CVE-2025-32711

---
Source: https://www.netzilo.com/threats/atr-credential-and-secret-exposure-in-agent-output