AI agents can leak secrets without layered safeguards

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Codenotary's blog post: Overly helpful AI agents can expose secrets when they can read files, run commands, and forward context into logs or external services.

Why it matters: It matters because IAM and security teams must govern AI agent access as a non-human identity problem, not a traditional user-behaviour problem, or secret leakage will happen before detection and response can help.

Context

AI agents that can inspect code, open files, execute commands and talk to external services create a distinct governance problem: they can move secrets out of intended boundaries faster than human review cycles can react. The control failure is usually not malicious behaviour, but over-broad access combined with weak filtering and poor boundary design.

That changes the security question from whether an agent is useful to whether its permissions, memory and output channels are constrained enough to stop accidental disclosure. Where agents are treated like ordinary automation, secret handling becomes a lifecycle problem rather than a one-time configuration choice.

Key questions

Q: How should security teams keep AI agents useful without letting them see secrets?

A: Use a credential broker or proxy so the agent can make authorised requests without ever handling the underlying tokens, API keys, or certificates. The agent should submit a request, and the broker should attach credentials on the outbound path. That keeps secret custody outside the agent runtime and reduces exfiltration risk from prompt injection or malicious content.

Q: Why do AI agents complicate identity governance compared with human users?

A: AI agents complicate identity governance because they act autonomously, can change tasks quickly, and often use multiple secrets, APIs, and delegated privileges across systems. Human IAM assumes a known person, stable approval workflows, and predictable accountability. Agents need machine-readable identity, continuous authorization, scoped access, lifecycle controls, and audit trails that capture actions, context, and delegation. Without those controls, governance gaps, overprivilege, and hidden access spread fast.

Q: What are the signs that shadow AI is leaking secrets?

A: Look for prompts containing API keys, tokens, connection strings, customer data, or regulated information, especially when the same workstation also runs local models or AI plugins. Repeated copy-and-paste into AI tools is a strong indicator that secret handling has escaped normal controls.

Q: How should organisations respond when AI-generated code exposes a secret?

A: Contain the exposure immediately by rotating or revoking the credential, then trace where it appeared in prompts, logs, repositories, and collaboration tools. After containment, review why the secret reached the workflow in the first place and tighten the control that failed, not just the one that detected it.

Technical breakdown

Why AI agents leak secrets through ordinary task execution

AI agents are not just text generators. When they can read files, inspect environment variables, run shell commands and call services, they operate across several trust boundaries in a single workflow. If a secret appears in context, the agent may echo it into a response, include it in a log line, or pass it into another tool without understanding confidentiality the way a human operator would. The failure mode is usually breadth of access, not intent. The moment a secret enters the agent’s working memory, every downstream channel becomes a potential disclosure path. See the AI Agent Authorisation Guide.

Practical implication: constrain what the agent can read and what it can return before it ever touches sensitive material.

Why layered controls are more effective than a single filter

A single guardrail rarely holds up across an AI workflow because leakage can occur at multiple stages. A file block can still leave the prompt polluted with sensitive context, and a prompt scrubber can still miss secrets generated by a tool response. Layered protection works because it separates three decisions: what the agent may access, what data reaches the model, and what output can leave the system. That reduces the chance that one missed control becomes a full disclosure event. In practice, the architecture matters more than the individual filter. Read Zero Trust for AI Agents.

Practical implication: place controls at access, context and output boundaries rather than relying on one inspection point.

How autonomous assistants turn secret handling into a non-human identity issue

Once an AI system can act on its own within a workflow, it should be governed as a non-human identity with scoped authority, not as a casual extension of a user session. The article’s core lesson is that secret exposure follows from identity and privilege design: an agent with broad standing access can observe and propagate data that a human might never be given. That makes the problem much closer to machine identity governance than to ordinary content moderation. The right control model is task-scoped authority, explicit delegation and revocation after use. See the Agentic AI Identity Guide.

Practical implication: treat agent credentials and permissions as governed identity assets with clear ownership and retirement rules.

Threat narrative

Attacker objective: The attacker or accidental recipient ends up with usable secrets, tokens or conversation data that can be reused for access, disclosure or further abuse.

1. Entry occurs when an AI agent is allowed to read source code, configuration files, shells or connected services as part of a normal task.
2. Credential or secret exposure follows when the agent encounters API keys, OAuth tokens or other sensitive values and includes them in context, logs or responses.
3. Impact occurs when the leaked secret leaves the local boundary and can be reused, shared or stored outside the intended control plane.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Hugging Face Spaces breach 2024: Unauthorised access to Hugging Face Spaces may have exposed secrets users stored for AI apps; tokens were revoked and org tokens removed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Secret leakage in AI agents is an identity and privilege problem before it is a data-loss problem. The decisive issue is not whether the model is clever enough to summarise safely, but whether the agent was ever allowed to see the secret in the first place. Once an autonomous system can read, remember and relay protected values, conventional human-centric confidentiality controls lose their leverage. Practitioners should govern AI agents as scoped identities with explicit authority boundaries.

Layered filtering only works when it is designed around the agent’s full execution path. A control that sits only at output time cannot undo secret exposure in the prompt or memory, and a pre-processing scrubber can still be bypassed by tool output. The article reinforces a broader lesson for NHI programmes: trust must be checked at access, context and egress, not assumed after the model has already seen the data. Teams should map every disclosure path, not just the obvious one.

OpenClaw-style leakage shows why over-broad agent access collapses the usual reviewer model. Human review assumes there is time to detect and correct a mistake after access is used. Agents can consume sensitive context, act on it and forward it in a single interaction, which means the mistake is often complete before anyone can intervene. Security teams should move governance to issuance time and define the agent’s usable scope up front.

Secret sprawl now includes machine conversation paths as well as repositories. Secrets no longer leak only through code commits and configuration files. They also leak through agent memory, chat history, connected services and collaboration tools, which broadens the attack surface beyond classic repository scanning. That makes machine identity hygiene inseparable from collaboration security and data boundary design. Practitioners should inventory every place an agent can store or forward a secret.

From our research library:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Read next: Zero Trust for AI Agents

What this signals

Over-privileged AI access is already a measurable incident driver: systems with least-privileged AI access had a 17% incident rate versus 76% for over-privileged systems, which shows that the control point is scope, not model accuracy. For programme owners, the priority is to move entitlement decisions earlier in the workflow and make agent access auditable before execution.

The practical governance shift is toward task-scoped AI authorisation and away from open-ended assistant access. If an agent can read files, shells and messaging tools without narrowly defined purpose, secret leakage becomes a predictable by-product rather than an edge case.

Agent secret handling now sits at the intersection of NHI governance and collaboration security. The same workflow that helps an assistant debug faster can also push credentials into chats, logs and external services. Teams should assume that memory, context and output are all disclosure surfaces and design controls accordingly.

For practitioners

• Restrict agent read access to the minimum needed Remove broad file, shell and service access from general-purpose assistants and grant only the resources required for the specific task.
• Sanitise context before the model sees it Filter configuration files, environment variables and prompt content so secrets are removed before they enter the agent’s working memory.
• Filter outputs before they leave the workflow Mask secrets in responses, logs and shared channels so a helpful answer cannot become a disclosure path.
• Treat agent credentials as governed identities Assign ownership, scope and retirement rules to each agent credential, token or delegated capability just as you would for other non-human identities.
• Test the full leak path end to end Simulate a debug request that would reveal a secret and verify that access blocking, prompt cleaning and output masking all stop the disclosure chain.

Key takeaways

• AI agents leak secrets when access, memory and output channels are wider than the task actually requires.
• The risk is amplified by non-human identity patterns, because the agent can move sensitive values faster than a human reviewer can intervene.
• Containing this problem depends on issuance-time scope, context scrubbing and output filtering working together, not on a single safeguard.

Related NHI Mgmt Group resources: AI Agent Authorisation Guide · Agentic AI Identity Guide · Zero Trust for AI Agents · AI Agent Observability, Audit and Incident Response Guide

Key terms

• AI Agent Secret Leakage: The unintended exposure of credentials, tokens, configuration values or other sensitive data while an AI agent is reading context or producing output. It usually happens because the agent is allowed to see more than it needs, then repeats or forwards that material through logs, chats or external services.
• Task-Scoped Access: Task-scoped access is permission granted for one defined purpose and removed once the task is complete or the session expires. For non-human identities, it reduces standing privilege and limits how long an attacker can exploit a stolen credential.
• Context Cleaning: The process of removing sensitive data from prompts, files or tool output before an AI model receives it. In practice, it is a boundary control that prevents confidential values from entering the model’s working memory in the first place.
• Output Filtering: Output filtering is the control layer that scans AI responses before they are released to the user. It looks for secrets, PII, internal identifiers, and policy violations, and it is essential when models can generate fluent but unsafe disclosures from privileged context.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners translate identity controls into operational safeguards for human and non-human access alike.