ComfyUI PNG metadata turns image sharing into secret exposure

At a glance

What this is: This analysis shows that ComfyUI PNG metadata can carry prompts, paths, network details and even live API keys into shared images, turning routine file sharing into a secret exposure path.

Why it matters: IAM and NHI teams need to treat image outputs as governed artifacts, because secret leakage can occur outside repositories, vaults and standard scanning paths.

By the numbers:

• Truffle Security identified 681 images with live API keys embedded in metadata.

👉 Read Truffle Security's analysis of ComfyUI PNG metadata and secret exposure

Context

ComfyUI is an image-generation workflow platform, but in this case the operational problem is not image quality. The issue is that its saved PNGs can carry hidden metadata containing prompts, paths, node state and credentials, which means the file itself becomes a secret-bearing object.

That changes the governance model for NHI and API keys. If a workflow can serialise live secrets into shared output files, then traditional vaulting and code scanning controls do not see the exposure path until after the artifact has already left the environment.

Key questions

Q: What breaks when AI image tools save workflow state into shared PNG files?

A: The control break is that the file becomes a secret-bearing artifact instead of a neutral output. Prompts, paths, node state and credentials can travel with the image after export, so normal repository scanning and vault controls no longer see the exposure path. Security teams need artifact-level handling, not just source-code hygiene.

Q: Why do embedded API keys in generated images create more risk than a simple file leak?

A: Because the image can preserve both the credential and the surrounding workflow context. That context can reveal what system the key belongs to, where it was used and which services or paths are in play, which increases the value of the exposed artifact for abuse and reconnaissance.

Q: What are the signs that image-generation workflows are leaking sensitive data?

A: Look for exported files that contain prompts, file paths, node names, webhook URLs, local IP addresses or live secrets when decoded. If shared outputs routinely contain operational metadata, the workflow is carrying more state than users expect and the leak will recur until export handling changes.

Q: How should teams govern third-party nodes that accept API keys in AI workflows?

A: Treat every custom node that accepts credentials as part of the identity perimeter and review how it stores, serialises and exports those values. If the node writes secrets into saved artifacts, it needs the same scrutiny as any other credential-handling integration in the environment.

Technical breakdown

How ComfyUI stores workflow state inside PNG files

ComfyUI writes hidden text blocks into exported PNGs so the image can be reloaded as a complete workflow. Those blocks can include prompts, negative prompts, sampler settings, model names, file paths and every text widget on the canvas, even if a node never executed. In practice, the file is not just an image. It is a portable representation of the generation environment, which is why casual sharing can leak operational context as well as creative output.

Practical implication: Treat image exports as governed artifacts and assume metadata must be stripped before any external sharing.

Why custom nodes turn metadata into secret leakage

The highest-risk exposure comes from community nodes that accept API keys or other credentials through plain text widgets. Because ComfyUI does not provide a dedicated secret input type for plugin authors, a key pasted into a text field can be serialised into the PNG alongside the workflow. Even bypassed nodes can still leave their widget values in the saved canvas state, which means a node that did not run can still expose a live credential.

Practical implication: Review third-party nodes for credential handling and remove any workflow pattern that stores secrets in plain text widgets.

Why PNG metadata bypasses normal NHI guardrails

This leak path sits outside the usual control plane. Secret scanners that focus on repositories, CI systems and vault stores will miss a credential if it is embedded in a user-generated image after workflow execution. That is why the article matters for NHI governance: the secret lifecycle now includes artifact output, not just storage and rotation. The exposure is especially hard to spot because the shared object still looks like an ordinary PNG.

Practical implication: Extend secret scanning and disposal rules to generated artifacts, not only source code and configuration files.

Threat narrative

Attacker objective: The attacker gains reusable credentials and private workflow context from a seemingly harmless shared image.

1. Entry occurs when a user pastes a live API key or other sensitive text into a ComfyUI workflow node.
2. Credential exposure follows when ComfyUI serialises that widget value into PNG metadata, even if the node is bypassed.
3. Impact occurs when the image is shared publicly, allowing anyone who opens the file to recover the embedded secret or contextual data.

Breaches seen in the wild

• Hugging Face Spaces breach 2024: Unauthorised access to Hugging Face Spaces may have exposed secrets users stored for AI apps; tokens were revoked and org tokens removed.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Artifact-level secret leakage is now part of the NHI attack surface: This article shows that a credential no longer has to live in code, CI logs or a vault export to become exposed. When a workflow platform serialises widget values into a shared PNG, the artifact itself becomes a secret container. The practitioner conclusion is that output governance must sit alongside credential governance.

Plain text widget design creates a governance blind spot: The platform pattern here is not unique to ComfyUI. Any ecosystem that accepts secrets through ordinary text inputs and then persists the resulting state in exported assets creates a recoverability problem for NHI teams. The implication is that plugin and extension ecosystems need a separate review model for secret-bearing fields.

Metadata stripping should be treated as a control, not a cleanup step: The article shows that the safest response is not merely to remind users to be careful. It is to assume that every generated image may contain operational data until metadata is removed. That shifts the control boundary from user behaviour to deterministic artifact handling.

Shared outputs now require secret lifecycle thinking: NHI governance has traditionally focused on issuance, rotation, revocation and offboarding. This case adds publication and redistribution as meaningful lifecycle stages for machine credentials. Practitioners should treat any shareable artifact carrying embedded state as part of the identity perimeter.

Image-generation workflows need a named control concept: secret-bearing artifacts: The better lens here is not just data leakage but secret-bearing artifacts, files whose metadata can expose credentials, topology and human context in one object. That concept helps security teams classify risk consistently across AI tooling, collaboration platforms and workflow engines. The practitioner conclusion is to inventory artifact types before secrets reach them.

From our research library:

• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
• DeepSeek alone generated 113,000 new exposed API keys in 2025, illustrating how new AI providers create credential exposure before security guardrails catch up, according to the State of Secrets Sprawl 2026.
• Read next: API Key Management Guide

What this signals

Secret-bearing artifacts: Security teams need a classification for outputs that can carry hidden credentials, because the export file itself becomes part of the identity lifecycle. When a workflow platform serialises widget values into a shareable asset, revocation alone is not enough unless the artifact is also cleaned or discarded.

The practical signal for IAM and NHI programmes is simple: if a workflow can output prompts, paths and tokens into user-shared files, then data loss prevention, secret scanning and artifact hygiene must be joined up before the next share event, not after a leak is confirmed.

For practitioners

• Strip metadata before sharing Re-encode generated PNGs so hidden text blocks, EXIF and workflow state are removed before the file leaves your environment.
• Block plain text secret fields in custom nodes Review community nodes that accept API keys, tokens or webhooks in ordinary text widgets and remove workflows that persist credentials in canvas state.
• Scan exported artifacts for secrets Run secret detection against rendered images and other generated files, not just source repositories, build logs and configuration stores.

Key takeaways

• ComfyUI-style image exports can turn a routine sharing action into a secret exposure event when workflow state and credentials are embedded in the file.
• The article’s scan across ten Discord servers found 159,752 images with metadata and 681 images with live API keys, which shows this is a real operational problem rather than a theoretical edge case.
• Security teams should treat generated artifacts as governed objects, strip metadata before sharing and scan exported files for secrets before they leave the environment.

Key terms

• Secret-Bearing Artifact: A file or output that contains sensitive material inside its metadata, embedded state or hidden fields rather than in the visible content. In AI workflows this matters because the export itself can become a credential carrier, even when the visible image or document looks harmless.
• Metadata Leakage: Metadata leakage is the unintended exposure of hidden file contents such as prompts, paths, notes, or credentials. In AI image workflows, the exported artefact can retain more operational context than the visible image, creating a durable disclosure channel that survives normal sharing habits.
• Workflow Serialization: Workflow serialization is the process of saving the structure and state of a running workflow into a file so it can be reproduced later. When serialization includes all canvas values, it can capture sensitive inputs, local paths, and other data that should not travel with the output.
• Plain Text Secret Field: A user interface field that accepts credentials as ordinary text rather than as a dedicated secret object. This design increases leakage risk because the value can be stored, copied and exported alongside the rest of the workflow state, especially in plugins and community nodes.

What's in the full article

Truffle Security's full article covers the operational detail this post intentionally leaves for the source:

• The exact metadata blocks ComfyUI writes into PNG files and how they differ between prompt and workflow data
• The scanning method used to verify live API keys inside exported images across public Discord communities
• Concrete examples of leaked prompts, file paths, network addresses and Google Drive links found in the corpus
• The one-line cleanup and verification workflow used to confirm that metadata stripping removed the exposed secrets

👉 The full Truffle Security article shows how the metadata leak works, what was found and how to verify cleanup.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.