# Environment Variable Existence Probing

- **Severity:** High
- **Signature ID:** `100b5c90-d886-43c5-952e-915e24ca9d74`
- **MITRE ATLAS:** AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI08 (Supply Chain Attacks on Agent Ecosystems), LLM02 (Sensitive Information Disclosure)

## Summary

An attacker asks an AI agent about sensitive environment variables like API keys or passwords. The agent replies that the variable exists but claims it cannot show the value — a response pattern that confirms a target for further probing and encourages the attacker to keep pushing for the actual secret.

## How the attack works

An attacker sends a prompt asking the agent to check whether a specific environment variable (often named like a credential, e.g. DATABASE_PASSWORD or API_KEY) is set. The agent responds by confirming the variable exists but states it cannot access or display its value. This half-answer is itself useful to the attacker: it verifies the secret is present and worth targeting. The attacker then follows up with different phrasing, encoding tricks, or indirect requests designed to get the agent to actually reveal or use the value.

## Why it matters

Confirming the existence of sensitive environment variables narrows an attacker's search and signals which secrets are worth the effort to extract, increasing the chance of eventual credential leakage.

## What you can do

- Configure agents to give a uniform, non-committal answer for both 'variable exists' and 'variable does not exist' cases rather than confirming presence.
- Restrict agent access to environment variables that hold credentials or secrets; use a secrets manager the agent cannot query directly.
- Review agent logs for repeated variable-existence queries followed by varied extraction attempts, which indicate active probing.
- If you run an internal auditing tool that legitimately lists configured variables, keep its output format distinct from conversational agent responses to reduce false alarms.

## Known benign look-alikes

- A security auditing tool that generates reports listing which environment variables are configured and which are missing, using similar phrasing like 'DATABASE_PASSWORD is set' in its output.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00146

---
Source: https://www.netzilo.com/threats/atr-environment-variable-existence-probing