# Secret Key Exfiltration Request

- **Severity:** High
- **Signature ID:** `ffe49cbb-b7e3-4c64-bca7-dc2aef3dc845`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This rule flags messages where a user directly asks an AI agent to disclose a secret, remembered, or hidden key value. It looks for the key being named and then immediately followed by a request for its literal value, often disguised as a task-ending or role-reset instruction.

## How the attack works

An attacker sends a message to the AI agent that names a secret, session, or system key. Right after naming it, they add a demand to see its exact value, sometimes phrasing it as 'give it verbatim' or 'without translation.' The message is often framed as an 'end of task' or role-reset instruction, trying to trick the agent into thinking the secret is now safe to share. This can also appear as a literal placeholder string like {$SECRET_KEY} that the attacker hopes the system will fill in and leak.

## Why it matters

If successful, the agent discloses a system or session secret key to the attacker, which can be used to impersonate the system, access protected resources, or escalate further attacks.

## What you can do

- Review agent logs for prompts that combine key references with disclosure demands, especially those framed as task-ending or role-reset instructions.
- Ensure agents are configured to never output secret or session key values regardless of how the request is phrased.
- Separate secret values from any context the agent can read or repeat back to users.
- Treat this as detection of one specific exfiltration attempt pattern, not full coverage of all prompt injection techniques.

## Known benign look-alikes

- Documentation referencing a bare SECRET_KEY environment variable name without an exfiltration cue
- Configuration file snippets that set or read SECRET_KEY without requesting its value be disclosed
- General discussion of secret-management best practices

## References

- https://agentthreatrule.org/en/rules/ATR-2026-02017

---
Source: https://www.netzilo.com/threats/atr-secret-key-exfiltration-request