High 2026-06-12

MCP/agent tool reads .env or secret file without user consent (OSV-MCPS-2025-EB70F912)

Some AI coding agents automatically open configuration and secret files like .env when analyzing a codebase, then send their contents to the model. This happens without any prompt asking the user for permission, so API keys, database passwords and other credentials can end up inside the agent's context or logs.

How the attack works

An agent's file-reading tool is invoked with a path pointing at a sensitive file such as .env, .env.local, secrets.*, credentials, .npmrc or .netrc. This can happen through normal function-call syntax like read_file(".env") or through a JSON argument such as {"path":".env"}. The tool ingests the file content and passes it to the model as part of routine codebase analysis, with no consent step in between. The result is that secrets stored in these files are exposed to the model/server even though the user never intended to share them.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID: 9357979f-bdfa-4b0b-9d9a-8647b8704dd3
Severity: High

Classification

AML.T0056 · Extract LLM System Prompt AML.T0057 · LLM Data Leakage ASI05 · Cascading Failures in Multi-Agent Systems ASI06 · Goal and Instruction Manipulation LLM02 · Sensitive Information Disclosure LLM07 · System Prompt Leakage

Why it matters

Credentials such as API keys and database passwords can leak into model context, logs, or downstream outputs, giving an attacker or an over-permissioned agent a path to systems the keys protect.

What you can do

→Keep secrets out of files an AI agent can read by default; use a secrets manager or environment injection at runtime instead of committed .env files.
→Add .env, .env.local, secrets.*, credentials and similar files to the agent's exclusion or ignore list before granting it file-read access.
→Review agent/tool logs for read calls targeting these filenames and rotate any credentials that were exposed.
→Require explicit user confirmation before any agent tool reads files matching secret-file naming patterns.

Known benign look-alikes

Natural-language prose that merely mentions a .env / secrets file ("create a .env file with your API key", "if you have a .env file in your project root") with no read-tool call or JSON path argument.
The CLI flag form `node --env-file=.env` or `--env-file <path-to-.env>` — an interpreter loading its own config, not an agent read-tool ingesting the file content for the model.
`dotenv.config()` / `load_dotenv()` in normal application source — runtime config loading by the app itself, not an MCP read tool surfacing secrets to the agent.
Searching/listing for the file (`find . -name ".env" -type f`) without reading its contents.
A read tool whose path argument targets a NON-secret config file (config.json, README.md, src/index.ts).