title: Credential and Secret Exposure in Agent Output id: ATR-2026-00021 rule_version: 1 status: stable description: | Detects when an AI agent exposes API keys, secret tokens, private keys, database connection strings, JWT tokens, or other sensitive credentials in its output. Covers all major cloud provider key formats, CI/CD tokens, payment processor keys, SSH keys, .env file content patterns, and generic secret assignment patterns. Credential leakage in agent output poses a critical security risk leading to unauthorized access, lateral movement, financial loss, and full account compromise. author: ATR Community date: 2026/03/08 schema_version: '0.1' detection_tier: pattern maturity: test severity: critical references: owasp_llm: - LLM02:2025 - LLM07:2025 cve: - CVE-2025-32711 owasp_agentic: - ASI03:2026 mitre_atlas: - AML.T0057 - LLM Data Leakage - AML.T0055 - Unsecured Credentials compliance: owasp_agentic: - id: ASI03:2026 context: Credential exposure in agent output enables adversaries to abuse the identity and privileges associated with leaked keys, directly enabling unauthorized resource access classified under ASI03:2026. strength: primary owasp_llm: - id: LLM02:2025 context: API keys, tokens, private keys, and database credentials are sensitive information whose disclosure in agent output is the canonical LLM02:2025 Sensitive Information Disclosure scenario. strength: primary - id: LLM07:2025 context: Credentials embedded in or derived from system prompts that appear in agent output constitute a LLM07:2025 System Prompt Leakage incident with direct security impact. strength: secondary eu_ai_act: - article: '12' section: '1' context: Article 12 requires automatic logging of events; a credential exposure incident is a high-severity event that must be automatically recorded and reported to the deployer for incident investigation. strength: primary - article: '9' context: Credential leakage is a documented risk class in the AI system risk management plan; Article 9 requires that monitoring controls are implemented to detect and respond to such events. strength: secondary - article: '15' context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Credential and Secret Exposure in Agent Output). strength: primary - article: '10' context: Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Credential and Secret Exposure in Agent Output) affecting that data. strength: secondary nist_ai_rmf: - function: Govern subcategory: GV.6.1 context: GV.6.1 requires organizational policies governing sensitive data and credentials in AI systems; this rule enforces those policies by detecting credential exposure at runtime. strength: primary - function: Manage subcategory: MG.3.1 context: Credential exposure requires an immediate risk treatment response; this detection rule is the technical implementation of the risk treatment plan for credential leakage events. strength: secondary - subcategory: MS.2.7 context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (Credential and Secret Exposure in Agent Output). strength: primary - subcategory: MS.2.10 context: NIST AI RMF MEASURE 2.10 (privacy risk examined and documented) is supported by this rule's detection of the context-exfiltration attempt (Credential and Secret Exposure in Agent Output). strength: secondary iso_42001: - clause: '8.4' context: Clause 8.4 AI system impact assessment must identify credential leakage as a high-severity impact scenario; this rule generates the detection evidence needed for audit and impact reporting. strength: primary - clause: '6.2' context: Protecting credentials from exposure is an explicit AIMS information security objective under clause 6.2; detection of leakage events measures whether this objective is being achieved. strength: secondary - clause: '8.1' context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Credential and Secret Exposure in Agent Output). strength: primary tags: category: context-exfiltration subcategory: credential-exposure scan_target: mcp confidence: high agent_source: type: llm_io framework: - any provider: - any detection: conditions: - field: agent_output operator: regex value: sk-[a-zA-Z0-9]{20,} description: OpenAI-style API key (sk-...) - field: agent_output operator: regex value: AKIA[0-9A-Z]{16} description: AWS Access Key ID (AKIA...) - field: agent_output operator: regex value: AIza[a-zA-Z0-9_-]{35} description: Google API key (AIza...) - field: agent_output operator: regex value: (?:sk_live|pk_live|sk_test|rk_live)_[a-zA-Z0-9]{20,} description: Stripe API key (sk_live_, pk_live_, rk_live_) - field: agent_output operator: regex value: eyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]+ description: JWT token (eyJ...eyJ...signature) - field: agent_output operator: regex value: '-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----' description: PEM or OpenSSH private key header - field: agent_output operator: regex value: ghp_[a-zA-Z0-9]{36} description: GitHub personal access token (ghp_...) - field: agent_output operator: regex value: xox[bpors]-[a-zA-Z0-9\-]{10,} description: Slack token (xoxb-, xoxp-, xoxs-) - field: agent_output operator: regex value: Bearer\s+[a-zA-Z0-9\-._~+/]{20,}=* description: Bearer token in authorization header - field: agent_output operator: regex value: (?:mongodb(?:\+srv)?|postgres(?:ql)?|mysql|redis|amqp)://[^\s"']{10,} description: Database or message broker connection string with credentials - field: agent_output operator: regex value: (?:DB_PASSWORD|DATABASE_URL|REDIS_URL|MONGO_URI|SECRET_KEY|JWT_SECRET|ENCRYPTION_KEY|PRIVATE_KEY|AUTH_TOKEN)\s*[=:]\s*["']?[^\s"']{8,} description: .env file pattern with sensitive variable names - field: agent_output operator: regex value: (?:api[_-]?key|api[_-]?secret|access[_-]?token|auth[_-]?token|client[_-]?secret)\s*[=:]\s*["']?[a-zA-Z0-9_\-]{16,} description: Generic secret assignment pattern (api_key=..., auth_token=...) - field: agent_output operator: regex value: (?:ANTHROPIC_API_KEY|OPENAI_API_KEY|GOOGLE_API_KEY|AZURE_API_KEY|COHERE_API_KEY|HF_TOKEN)\s*[=:]\s*[^\s]{8,} description: LLM provider API key environment variables - field: agent_output operator: regex value: (?:ssh-rsa|ssh-ed25519|ecdsa-sha2-nistp256)\s+[A-Za-z0-9+/]{40,} description: SSH public key that may indicate key material exposure context - field: agent_output operator: regex value: (?:secret["'\s]*[:=]["'\s]*[a-zA-Z0-9]{16,}|password["'\s]*[:=]["'\s]*[^\s"']{8,}) description: Generic secret or password assignment condition: any false_positives: - Agent discussing API key formats in educational context without real keys - Redacted or placeholder keys such as sk-xxxxxxxxxxxx or AKIA_EXAMPLE - Documentation examples using clearly fake credentials - Connection string templates with placeholder values response: actions: - escalate - alert - snapshot actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): benign FP 212/5352 = 3.96% exceeds the 2% automatic-demotion line; ceiling = observe. Removed block_output(interrupt). Detection unchanged — recall cost is zero.' auto_response_threshold: critical message_template: | [ATR-2026-021] CRITICAL: Credential or secret detected in agent output. This rule no longer redacts or blocks output; it alerts and escalates. The hook may still deny on severity — see docs/RESPONSE-ACTION-ELIGIBILITY.md. Rotate any potentially exposed credentials immediately. Pattern: {matched_pattern}. Session: {session_id}. confidence: 87 wild_validated: 2026/04/08 wild_samples: 53577