title: Obfuscated API Key Disclosure
id: ATR-2026-00145
rule_version: 1
status: experimental
description: |
  Detects attempts to leak API keys wrapped in fake encryption/encoding, e.g. "AES256(sk-proj-real-key)". The attacker hopes the agent treats the "encrypted" value as safe to transmit while it contains the real key. Crystallized from 29 adversarial samples.
author: ATR Threat Cloud Crystallization
date: 2026/04/07
schema_version: '1.0'
detection_tier: pattern
maturity: test
severity: critical
references:
  mitre_atlas:
    - AML.T0057 - LLM Data Leakage
  owasp_llm:
    - LLM02:2025
  owasp_agentic:
    - ASI08:2026
metadata_provenance:
  mitre_atlas: auto-generated
compliance:
  nist_ai_rmf:
    - subcategory: MS.2.10
      context: This rule detects API key exfiltration disguised by fake encryption wrappers like 'AES256(sk-proj-...)'; MS.2.10 requires that privacy and sensitive-data leakage risks are continuously assessed, and these detections directly evidence credential disclosure attempts.
      strength: primary
    - subcategory: MS.2.7
      context: Obfuscated key disclosure is an evasion technique against output filters; MS.2.7 requires evaluation of system security and resilience against adversarial bypass tactics that defeat naive secret-detection controls.
      strength: secondary
    - subcategory: MG.2.3
      context: Detection of fake-encryption-wrapped credentials must trigger response plans to block transmission and revoke exposed keys; MG.2.3 requires mechanisms to supersede or disengage AI actions before the leak completes.
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Obfuscated API Key Disclosure).
      strength: primary
    - clause: '6.2'
      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Obfuscated API Key Disclosure) is such a treatment.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Obfuscated API Key Disclosure).
      strength: primary
    - article: '10'
      context: Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Obfuscated API Key Disclosure) affecting that data.
      strength: secondary
tags:
  category: context-exfiltration
  subcategory: obfuscated-key
  confidence: high
  scan_target: mcp
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  condition: any
  conditions:
    - field: content
      operator: regex
      value: (?i)(?:encrypted|ciphertext|encoded|hashed|wrapped|obfuscated)\s*(?:version|form|key|value|content|representation|credentials?)?\s*(?:is|reads?|:|=)\s*(?:AES|RSA|DES|SHA|HMAC|BASE64|ROT13)\d*\s*\(\s*(?:sk-|ghp_|gho_|glpat-|xoxb-|AKIA|api[_-]?key)
      description: Fake encryption wrapping real API key prefixes
  false_positives:
    - 'A security training document or CTF challenge write-up that demonstrates fake encryption wrapping of example API key prefixes (e.g., ''encrypted key: AES256(sk-example)'') as part of an educational walkthrough.'
confidence: 41
wild_validated: 2026/04/08
wild_samples: 53577
response:
  actions:
    - alert
    - block_output
    - snapshot