# Obfuscated Credential Exfiltration via Encoding

- **Severity:** High
- **Signature ID:** `985298c7-93cc-4be3-b2d8-2955ee893122`
- **MITRE ATLAS:** AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects a trick where someone tries to get an AI agent to output real passwords, API keys, or tokens by dressing them up as encrypted or encoded values. Framing the secret as AES256() output, hex, or rot13 text can fool content filters that only look for plain, obviously-sensitive strings.

## How the attack works

An attacker asks the agent to reveal a credential but wraps the request or the output format so the actual secret is labeled as 'encrypted key', hex, or rot13 text. Content filters that scan for plaintext credential patterns don't recognize the wrapped version and let it through. The agent outputs what looks like ciphertext or encoded gibberish, but it is actually the real, usable credential in a thin disguise. The attacker then decodes or 'decrypts' the output trivially outside the conversation to recover the working credential.

## Why it matters

An organization can lose real credentials — API keys, tokens, passwords — that pass through automated filters undetected because they're superficially formatted as encrypted or encoded data, leading to unauthorized access to whatever those credentials protect.

## What you can do

- Do not rely solely on plaintext pattern matching for credential leak filters; also flag AES256(), hex, base64, or rot13 wrappers applied to output that could contain secrets.
- Review agent logs for outputs labeled 'encrypted key', 'encoded token', or similar framing and check whether the wrapped content decodes to a real credential.
- Restrict agents from ever outputting raw credential material regardless of encoding, encryption, or obfuscation framing.
- Treat security documentation and pentest reports as legitimate exceptions, but verify any embedded 'sample' keys are not live credentials.

## Known benign look-alikes

- Security documentation about encryption
- Encryption tutorials with example keys
- A penetration testing report that documents the finding pattern 'encrypted token=' as a vulnerability example in prose, potentially matching pattern [1] if followed by a sample key prefix
- Automated security scanner output that logs intercepted credential patterns including prefixes like sk- or ghp_ alongside words like 'encoded' or 'obfuscated' in its finding descriptions

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00152

---
Source: https://www.netzilo.com/threats/atr-obfuscated-credential-exfiltration-via-encoding