Natural-Language Credential / Secret Disclosure Instruction
This detects text aimed at an AI agent that orders it to disclose API keys, passwords, tokens, or other credentials as part of its output. It targets attempts to trick an agent into leaking secrets it has access to, rather than normal documentation about credentials.
How the attack works
An attacker embeds an instruction — in a prompt, a document the agent reads, or injected content — that combines a command verb like 'disclose', 'reveal', 'include', or 'append' with a sensitive term such as 'API key', 'credential', 'secret', 'token', 'password', or 'environment variable'. The phrasing is directive, using words like 'you must', 'always', or 'disclose any', pushing the agent toward compliance rather than just describing how credentials work. If the agent follows the instruction, it prints or forwards secrets it holds in its context, memory, or environment. This is one specific technique for extracting secrets from an agent, not a full account of how such secrets got into its reach in the first place.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- fb9c9d53-fc0a-4073-b689-87d524cb6f70
- Severity
- Critical
Why it matters
If successful, an organization's API keys, passwords, or tokens end up exposed in the agent's response, giving an attacker direct access to connected systems and accounts.
What you can do
- →Keep credentials and secrets out of an agent's context window or memory whenever possible; use short-lived tokens fetched at call time instead.
- →Filter or block agent inputs and outputs that combine imperative disclosure language with sensitive credential terms.
- →Review any content sources the agent reads (documents, web pages, user messages) for injected instructions before they reach the model.
- →Log and alert when an agent's output contains patterns resembling API keys, tokens, or passwords, regardless of the triggering prompt.
Known benign look-alikes
- Documentation explaining how API keys work or how to set them
- Setup guides telling users where to PUT their own keys (not the agent to disclose them)
- Security advisories about credential leakage
- Detection rule write-ups discussing this exact pattern