Environment Variable Enumeration for Secrets

How the attack works

An attacker with the ability to influence what commands an AI agent executes (through a prompt injection, a malicious tool, or direct control) instructs the agent to print or list environment variables, for example using commands like 'env', 'printenv', or 'set'. Environment variables commonly store API keys, database passwords, cloud credentials, and other tokens for the runtime environment. The agent runs the command and returns the output, which the attacker then reads. With those secrets, the attacker can access other systems, cloud accounts, or APIs the credentials belong to.

Netzilo detection

Why it matters

Successful enumeration can expose live API keys and credentials, letting an attacker pivot into cloud accounts, databases, or third-party services connected to the compromised environment.

What you can do

• →Avoid storing long-lived secrets in environment variables accessible to agent processes; use a secrets manager with short-lived, scoped credentials instead.
• →Restrict which commands an AI agent is allowed to execute, and block or flag generic environment-dumping commands unless explicitly required.
• →Review agent logs for unexplained environment variable listing, especially right after receiving external or untrusted input.
• →Rotate any credentials that were ever placed in plain environment variables accessible to an agent with broad command execution.

Known benign look-alikes

• Developers debugging environment variable configuration
• CI/CD pipelines that inspect environment for configuration validation

References

• https://attack.mitre.org/techniques/T1552/001/
• https://attack.mitre.org/techniques/T1082/

Related threats