Credential Data Leaked in Tool Response
An AI agent calls a tool - say a weather API or search engine - and the response secretly contains what looks like a private key, API token, or password. The agent may then treat that credential as legitimate data and act on it, repeat it back, or pass it along, which an attacker can exploit to exfiltrate secrets or hijack the agent's next actions.
How the attack works
An attacker controls or poisons the output of a tool an agent calls, such as a weather service, search API, or webpage the agent fetches. They embed credential-like strings (private keys, API tokens, passwords) inside otherwise normal-looking output. The agent ingests this tool response as trusted data and may echo it, store it, or use it in subsequent actions. Because the injection rides inside legitimate tool output rather than direct user input, it bypasses input-level filtering aimed at the user-agent conversation.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- db98e52d-4ef4-4c3e-bb07-feb4bcd8238c
- Severity
- Critical
Why it matters
An organization can lose control of real credentials if an agent is tricked into treating attacker-planted secrets as legitimate, or the agent can be manipulated into further unauthorized actions using the injected material. This is one step in a larger attack chain - the rule flags the injection point, not full exfiltration or downstream misuse.
What you can do
- →Treat all tool and API responses as untrusted input and sanitize or filter them before they reach the agent's context.
- →Block or redact strings matching credential patterns (private keys, API tokens, password formats) in tool output before the agent processes it.
- →Restrict what agents can do with data extracted from tool responses, especially passing it to other tools or external destinations.
- →Review logs of tool responses for embedded credential-like patterns, and expect false positives from documentation or security-scanning tools that legitimately discuss or report key formats.
Known benign look-alikes
- Documentation about key formats
- Security tools that intentionally scan for leaked keys
- Automated security scanning tools (e.g., truffleHog, git-secrets) that output detected credential patterns in their findings reports
- Developer documentation or tutorials that include example PEM headers to illustrate certificate/key file formats