OAuth and API Token Interception
An attacker can instruct an AI agent to grab authentication tokens, bearer tokens, or client secrets it has access to and send them somewhere the attacker controls. This turns the agent into a channel for stealing the credentials it uses to talk to other services.
How the attack works
The attacker crafts instructions (directly or via injected content) that ask the agent to read authorization headers, refresh tokens, or client secrets from its own context or memory. The agent is then told to forward these values to an external endpoint, often disguised as a legitimate-looking redirect_uri or callback URL in an OAuth flow. In some cases the request asks for bulk extraction of multiple tokens at once rather than a single credential. Once the attacker receives the token, they can use it to impersonate the agent or the user it acts on behalf of against the real service.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7c542951-498e-47ad-a52a-e9c289163d69
- Severity
- High
Why it matters
Stolen OAuth tokens and API keys let an attacker access connected accounts and services without needing a password, often bypassing normal login alerts since the token appears valid. This can lead to unauthorized data access, further impersonation, or lateral movement into other integrated systems.
What you can do
- →Restrict what token or credential values an agent can read from its own execution context or environment variables.
- →Validate and allowlist redirect_uri values used in any OAuth flow the agent participates in; reject unexpected or attacker-supplied endpoints.
- →Use short-lived tokens with narrow scopes for agent-to-service authentication so a leaked token has limited value.
- →Monitor for agent outputs that include authorization headers, bearer tokens, or client secrets being sent to external URLs, and review any bulk token access requests.
Known benign look-alikes
- OAuth client libraries performing legitimate token refresh
- API documentation showing token usage examples
- CI/CD pipeline configuration files that contain redirect_uri settings pointing to staging or QA environments
- Developer documentation or README files showing example client_secret placeholders for onboarding tutorials