OAuth Token Abuse - Literal OAuth Token in Agent Subprocess Egress
This detects an AI agent running a command-line tool like curl or wget where the command itself contains a real, working OAuth or API token instead of a variable reference. That means the token has already been exposed somewhere and is now being sent out over the network in plain text, which lets whoever intercepts or logs it reuse it to act as the agent or its user.
How the attack works
An OAuth token (Google, GitHub, Slack, a Bearer JWT, or a similarly shaped access/refresh token) ends up hard-coded into a command the agent runs, rather than being pulled in via an environment variable or a credential-fetch call. The agent then spawns curl, wget, httpie, or a PowerShell equivalent to reach an external http(s) address, with that literal token embedded in the command line. This is the last visible step of a token-theft chain: the token was already pulled from context, logs, or storage before this point, and this event is it being replayed against a real API.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 6f1c9b74-3a5e-4d2c-9b41-8e0d7a2c5f13
- Severity
- High
Why it matters
A leaked token used this way lets an attacker impersonate the agent or the user it acts for against the external service, with whatever access that token grants - potentially reading or modifying data in Google, GitHub, Slack, or any Bearer-token-protected API.
What you can do
- →Audit how the agent's shell or subprocess tool sources credentials; require indirect references (env vars, vaults, provider CLIs) and forbid literal secrets in command strings.
- →Review any command-line history or execution logs for tokens appearing in plaintext, and rotate any token found exposed this way immediately.
- →Restrict or log outbound network calls made by agent subprocesses so unexpected destinations for token-bearing requests are visible.
- →Treat matches as needing manual triage: distinguish legitimate token-refresh calls (e.g. refresh_token to a provider's own token endpoint) from an agent leaking a live token to an arbitrary external host.
Known benign look-alikes
- An engineer debugging a live API through the agent's shell tool who pastes a real short-lived access token directly into a curl command instead of using an environment variable.
- Helper or bootstrap scripts that resolve a secret from a vault into a shell variable and then echo/expand it inline before invoking curl, so the expanded literal appears on the child process command line.
- Legitimate OAuth refresh or token-exchange flows executed with curl against a provider token endpoint, where refresh_token=<value> is genuinely present in the POST body.
- Slack / GitHub App installation or troubleshooting runbooks that include a real bot or installation token in the documented command.
- Authorised red-team, secret-scanning validation, or credential-rotation drills that intentionally transmit a live token.