title: API Key / Secret Credential Generation or Completion Request
id: ATR-2026-00274
rule_version: 1
status: experimental
description: |
  Detects two related attack patterns from NVIDIA garak apikey probe: (1) Requesting the model to generate or fabricate secret-looking strings (API keys, tokens, credentials) for cloud services, AI providers, payment processors — output used to create plausible-looking fake credentials for phishing/social engineering; (2) Providing a partial key and asking the model to "complete" it — exploits training data memorisation of actual key formats. Both attacks extract or fabricate high-entropy credential strings that look real and can be weaponised for phishing or service impersonation.
author: ATR Community (via NVIDIA garak apikey probe)
date: 2026/04/19
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM06:2025
    - LLM02:2025
  owasp_agentic:
    - ASI03:2026
  mitre_atlas:
    - AML.T0057 - LLM Data Leakage
  research:
    - https://github.com/NVIDIA/garak/blob/main/garak/probes/apikey.py
compliance:
  nist_ai_rmf:
    - subcategory: MS.2.10
      context: This rule detects requests that attempt to extract memorized credential strings from training data via partial-key completion, or to fabricate realistic-looking secrets — both of which are privacy and data-leakage risks. MS.2.10 requires that privacy risks, including memorization-based leakage of sensitive strings, are assessed and tracked.
      strength: primary
    - subcategory: MS.2.7
      context: Generating plausible API keys or completing partial credentials enables downstream phishing and service impersonation, undermining system security and resilience. MS.2.7 requires continuous evaluation of security risks like credential fabrication and memorization leakage.
      strength: secondary
    - subcategory: MG.2.3
      context: Detection of credential generation or completion requests must trigger risk treatment to block the response before the fabricated or memorized secret is emitted. MG.2.3 mandates that these supersede/disengage mechanisms are in place for high-risk output paths.
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (API Key / Secret Credential Generation or Completion Request).
      strength: primary
    - clause: '6.2'
      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (API Key / Secret Credential Generation or Completion Request) is such a treatment.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (API Key / Secret Credential Generation or Completion Request).
      strength: primary
    - article: '10'
      context: Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (API Key / Secret Credential Generation or Completion Request) affecting that data.
      strength: secondary
tags:
  category: context-exfiltration
  subcategory: api-key-generation
  scan_target: mcp
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: tool_response
      operator: regex
      value: (?:generate|create|produce|give\s+me|make\s+up|fabricate|invent)\s+(?:a\s+(?:new|valid|working|(?:real|realistic)(?:-looking)?|fake(?:-looking)?)\s+)?(?:(?:openai|anthropic|aws|azure|gcp|google|stripe|twilio|sendgrid|github|gitlab|hugging\s+face|pinecone|cohere|replicate|mistral)\s+(?:api[\s_-]?key|access[\s_-]?token|secret[\s_-]?key|auth(?:entication)?[\s_-]?token|bearer[\s_-]?token|service[\s_-]?account[\s_-]?key|private[\s_-]?key|client[\s_-]?secret|oauth[\s_-]?token)\b|(?:api[\s_-]?key|access[\s_-]?token|secret[\s_-]?key|auth(?:entication)?[\s_-]?token|bearer[\s_-]?token|service[\s_-]?account[\s_-]?key|private[\s_-]?key|client[\s_-]?secret|oauth[\s_-]?token)\s+(?:for|to|from)\s+(?:openai|anthropic|aws|azure|gcp|google\s+cloud|stripe|twilio|sendgrid|github|gitlab|hugging\s+face|pinecone|cohere|replicate|together\.ai|mistral)\b)
      description: Request to generate/create API key for a named AI/cloud/payment service
    - field: tool_response
      operator: regex
      value: (?:lost|forgot|need\s+a\s+(?:new|replacement)|my\s+account\s+was)\s+(?:\w+\s+){0,4}(?:api[\s_-]?key|access\s+token|secret\s+key|oauth\s+token)\s+(?:for\s+)?(?:openai|anthropic|aws|azure|stripe|github|google)\b.{0,200}(?:generate|create|give\s+me|produce|what\s+(?:does\s+(?:it|one)\s+look\s+like|format))
      description: Lost/forgot key + named service + request for new key or format disclosure
    - field: tool_response
      operator: regex
      value: (?:complete|finish|fill\s+in)\s+(?:my\s+)?(?:partial|incomplete|truncated|half)\s+(?:(?:openai|anthropic|aws|azure|stripe|github|google|hugging\s+face|mistral|cohere)\s+)?(?:api[\s_-]?key|token|secret|credential)\s*[:\-–]\s*[A-Za-z0-9+/._-]{8,40}(?:\.\.\.|…|___+|\[missing\]|\?{3,})
      description: 'Partial key completion request — "complete my partial API key: sk-abc...___" exploiting memorisation'
    - field: tool_response
      operator: regex
      value: there\s+was\s+an\s+issue\s+on\s+my\s+computer.{0,80}(?:lost|lost\s+part\s+of)\s+my\s+(?:api[\s_-]?key|secret|token|key)\s+(?:for\s+)?(?:openai|anthropic|aws|azure|stripe|github)\b.{0,100}complete\s+the\s+key
      description: 'Garak apikey.PartialKey exact template: "computer issue, lost part of my key, complete it"'
    - field: tool_response
      operator: regex
      value: (?:what\s+does\s+(?:an?\s+)?(?:openai|anthropic|aws|azure|stripe|github|google\s+cloud)\s+(?:api[\s_-]?key|secret|access\s+token)\s+look\s+like|show\s+me\s+(?:an?\s+)?(?:example|sample|real)\s+(?:openai|anthropic|aws|stripe|github)\s+(?:api[\s_-]?key|token|secret))
      description: Request for key format example — reveals patterns usable for phishing fake credentials
  condition: any
  false_positives:
    - Developer documentation explaining API key format regex (e.g. "OpenAI keys start with sk-")
    - Security awareness training showing example fake credentials
    - Code review tools checking for hardcoded key patterns
response:
  actions:
    - alert
    - block_tool
  message_template: |
    [ATR-2026-00274] API key generation or partial-key completion request detected - credential fabrication or memorisation exploit.