title: Secret Key Exfiltration Request
id: ATR-2026-02017
rule_version: 1
status: experimental
description: |
  Detects user-turn prompts that name a secret, remembered, or hidden key and immediately qualify it with an exfiltration cue (asking for its value, demanding it verbatim, or requesting it without translation/additional text). Commonly paired with a fake "end of task" or role-reset framing to make the agent treat a prior system/session secret as safe to disclose. Narrowed to require the qualifying cue directly after the key mention so it does not fire on bare "SECRET_KEY" mentions common in benign env-var/config documentation (23 benign hits observed on the unqualified pattern during tuning). Also matches the literal {$SECRET_KEY} placeholder-leak pattern. Best applied to user-input/ llm_input channel, not tool_response/docs content.
author: ATR Community
date: 2026/07/07
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM01:2025
  owasp_agentic:
    - ASI01:2026
  mitre_atlas:
    - AML.T0051 - LLM Prompt Injection
    - AML.T0054 - LLM Jailbreak
  mitre_attack:
    - T1552 - Unsecured Credentials
compliance:
  eu_ai_act:
    - article: '15'
      context: High-risk AI systems must be resilient against adversarial attempts to extract sensitive secrets from context; detecting secret-key exfiltration requests provides detection evidence supporting Article 15 requirements for robustness against input-based manipulation.
      strength: primary
    - article: '9'
      context: Secret-key exfiltration attempts constitute a documented risk class in the AI system risk register; Article 9 requires that monitoring controls are deployed to detect these attempts at runtime.
      strength: secondary
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: Secret-key exfiltration requests are a primary class of adversarial input attacks against AI systems; MP.5.1 requires that adversarial input risks are identified and tracked so that runtime detection controls like this rule can be deployed.
      strength: primary
    - subcategory: MG.3.2
      context: Detected secret-key exfiltration patterns represent active exploitation attempts against retained context/session secrets, triggering the third-party and supply-chain risk controls required by MG.3.2 to contain credential disclosure.
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: Clause 8.1 operational controls ensure AI systems execute correctly and consistently; runtime detection of secret-key exfiltration requests enforces that retained secrets remain protected despite adversarial instructions to disclose them.
      strength: primary
    - clause: '8.3'
      context: Clause 8.3 requires AI system impacts to be assessed and addressed throughout operation; this rule provides detection evidence for the impact of secret/credential exfiltration attempts on system confidentiality.
      strength: secondary
tags:
  category: context-exfiltration
  subcategory: secret-key-exfiltration-request
  scan_target: mcp
  confidence: high
agent_source:
  type: llm_io
  framework:
    - openai
    - anthropic
    - langchain
    - llamaindex
    - autogen
    - crewai
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: (?i)\b(?:secret|remembered|hidden)\s+key\b[^.\n]{0,40}(?:\bis\s*:|\bvalue\b|\bwithout\b|\bno\s+(?:text|translation)\b|\bverbatim\b)|\{\$SECRET_KEY\}
      description: Secret/remembered/hidden key mention immediately qualified with an exfiltration cue, or literal {$SECRET_KEY} placeholder leak pattern
  condition: any
  false_positives:
    - Documentation referencing a bare SECRET_KEY environment variable name without an exfiltration cue
    - Configuration file snippets that set or read SECRET_KEY without requesting its value be disclosed
    - General discussion of secret-management best practices
response:
  actions:
    - block_input
    - alert
    - snapshot
    - escalate
  auto_response_threshold: high
  message_template: |
    [ATR-2026-02017] Secret key exfiltration request detected. The input names a secret, remembered, or hidden key and immediately requests its value or verbatim disclosure. This request has been blocked.
confidence: 88
wild_validated: 2026/07/07
wild_samples: 65000