title: Credential Data Leaked in Tool Response
id: ATR-2026-00150
rule_version: 1
status: experimental
description: |
  Detects private keys, API tokens, or credential material embedded in tool responses. Attackers embed credential data in seemingly benign tool output (weather, search results) to trick agents into exfiltrating secrets. Crystallized from 37 adversarial social_engineering samples.
author: ATR Threat Cloud Crystallization
date: 2026/04/08
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  mitre_atlas:
    - AML.T0055 - Unsecured Credentials
    - AML.T0057 - LLM Data Leakage
  owasp_llm:
    - LLM02:2025
  owasp_agentic:
    - ASI03:2026
metadata_provenance:
  mitre_atlas: auto-generated
compliance:
  nist_ai_rmf:
    - subcategory: MS.2.10
      context: This rule directly detects PEM private keys, SSH keys, and API tokens embedded in tool responses, which is a privacy/confidentiality risk assessment signal; MS.2.10 requires that privacy risks such as credential and sensitive data exposure are assessed and documented.
      strength: primary
    - subcategory: MS.2.7
      context: Credential material smuggled into tool output represents a security/resilience failure where untrusted third-party tool responses can exfiltrate secrets through the agent; MS.2.7 requires evaluation of such security risks in the AI system.
      strength: secondary
    - subcategory: MG.2.3
      context: Detection of leaked credentials in tool responses must trigger response mechanisms to disengage or block the agent before it propagates or acts on the exfiltrated secrets; MG.2.3 requires these supersede/deactivate controls be in place.
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Credential Data Leaked in Tool Response).
      strength: primary
    - clause: '6.2'
      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Credential Data Leaked in Tool Response) is such a treatment.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Credential Data Leaked in Tool Response).
      strength: primary
    - article: '10'
      context: Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Credential Data Leaked in Tool Response) affecting that data.
      strength: secondary
tags:
  category: context-exfiltration
  subcategory: credential-in-response
  confidence: high
  scan_target: mcp
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: (?i)-----BEGIN\s+(RSA\s+)?PRIVATE\s+KEY-----
      description: PEM private key in tool response
    - field: content
      operator: regex
      value: (?i)(id_rsa|id_ed25519|id_ecdsa)\s+(contains|has|file)[:\s]
      description: SSH key file reference with content disclosure
    - field: content
      operator: regex
      value: (?i)(sk-(?:proj-|ant-|live-)\S{10,}|ghp_\S{30,}|gho_\S{30,}|glpat-\S{10,}|xox[bpras]-\S{10,})
      description: API token pattern (OpenAI, Anthropic, GitHub, GitLab, Slack)
  condition: any
  false_positives:
    - Documentation about key formats
    - Security tools that intentionally scan for leaked keys
    - Automated security scanning tools (e.g., truffleHog, git-secrets) that output detected credential patterns in their findings reports
    - Developer documentation or tutorials that include example PEM headers to illustrate certificate/key file formats
response:
  actions:
    - block_tool
    - alert
  message_template: |
    [ATR-2026-150] Credential data detected in tool response. Private key or API token found embedded in output. This may indicate an exfiltration attempt.
confidence: 65
wild_validated: 2026/04/08
wild_samples: 53577