Credential Theft by AI Agents

AI agents that handle credentials, access secrets, or operate in environments with stored credentials are targets for credential theft. An attacker who compromises an agent's behavior can instruct it to read, transmit, or misuse credentials it has access to.

How Agents Access Credentials

Agents encounter credentials in several ways: environment variables in their runtime, configuration files on disk, secrets passed as tool parameters, credentials returned from vault APIs, and tokens embedded in API responses.

Each of these is an opportunity for a manipulated agent to capture and exfiltrate credentials.

Attack Scenarios

Environment variable reading. A prompt injection payload instructs the agent to "print all environment variables." If the agent has a code execution tool, it runs os.environ or process.env and returns the results, which often include database passwords, API keys, and service tokens.

Configuration file access. An agent with file system access reads .env, config.yaml, or credentials.json files. Even agents not intended to read these files might access them if path restrictions are not enforced.

Token relay. An agent receives an API token for one service and is manipulated into sending it to an attacker-controlled endpoint through its HTTP request tool.

Memory extraction. In multi-turn conversations, credentials mentioned in earlier messages persist in the context window. A later injection can reference and exfiltrate them.

Prevention

Never expose credentials in environment variables accessible to agent code. Use a secrets manager that provides credentials only to specific tool implementations, not to the agent's general context.

Block credential patterns in output. Authensor's Aegis scanner detects API keys, tokens, and password patterns in agent output. Redact them before the output reaches any external destination.

File access policies. Authensor's policy engine blocks access to credential files. Define explicit deny rules for paths matching .env, *credentials*, *secret*, and *.pem.

Network egress controls. Restrict which endpoints the agent can contact. Even if an agent captures credentials, it cannot exfiltrate them if outbound requests are limited to an allowlist.

Rotate credentials regularly and monitor for unauthorized usage. If an agent's credentials are compromised, short-lived tokens limit the exposure window.

Audit

Log all credential access through the audit trail. Every secret retrieval, token usage, and credential-adjacent file access should be recorded. Authensor's receipt chain provides the evidence needed to trace a credential theft incident from initial compromise through exfiltration.