How AI observability redaction changes secret exposure risk

At a glance

What this is: This is an analysis of prompt-side redaction for AI observability agents and the finding that telemetry can expose secrets unless every model call is scrubbed first.

Why it matters: It matters because IAM, PAM, and NHI teams have to assume observability agents can ingest live credentials from logs, traces, and tool outputs unless redaction is enforced at the model boundary.

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
• 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded.
• 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation.

👉 Read Edge Delta's analysis of AI telemetry redaction and secret exposure

Context

AI observability tools sit in a sensitive position because they read the same telemetry that incident responders use, and that telemetry often contains secrets. Bearer tokens, AWS keys, database connection strings, and other credentials can appear in logs, traces, tool payloads, and crash output, which means an AI agent can inherit exposure simply by investigating production systems.

The identity security question is not whether telemetry is useful, but whether model-bound workflows can prevent secret leakage without breaking investigation quality. For IAM, PAM, and NHI programmes, this is a governance problem at the point where operational data becomes model context, and the starting position in this article is unusual only in how explicitly it treats redaction as an access-control boundary.

Key questions

Q: How should security teams keep AI agents useful without letting them see secrets?

A: Use a credential broker or proxy so the agent can make authorised requests without ever handling the underlying tokens, API keys, or certificates. The agent should submit a request, and the broker should attach credentials on the outbound path. That keeps secret custody outside the agent runtime and reduces exfiltration risk from prompt injection or malicious content.

Q: Why do AI observability workflows increase the risk of credential exposure?

A: Because observability data often contains bearer tokens, API keys, and connection strings that were never meant for model processing. Once an agent can read the full diagnostic conversation, the prompt becomes a path for secret transfer rather than a neutral troubleshooting input.

Q: What are the signs that redaction controls are failing in AI pipelines?

A: Watch for missing placeholder substitution, unfiltered secrets in repeated transcripts, category-specific scan errors, and stale policy states that outlive their source. Those signals show the boundary is no longer consistently stripping sensitive material before model processing.

Q: Should organisations fail open or fail closed when prompt redaction breaks?

A: Fail open is defensible when availability matters during incidents, but only if monitoring, audit events, and cached policy state can prove the boundary is still under control. If the organisation cannot detect degradation quickly, fail-open behaviour becomes a disclosure risk rather than a resilience choice.

Technical breakdown

Why telemetry becomes a secret-exposure channel for AI agents

Observability pipelines collect raw application output, and raw output is where credentials tend to surface. A model-based agent that reads logs, traces, and tool responses can therefore inherit bearer tokens, API keys, and connection strings that were never intended for third-party processing. The architectural risk is not the model itself. It is the absence of a boundary between diagnostic data and prompt context. Once the agent can see the whole conversation, every upstream system that writes sensitive material into telemetry becomes part of the trust surface.

Practical implication: treat the model prompt boundary as a data-loss prevention control, not just an AI feature.

How placeholder-based redaction preserves investigative value

A useful redaction layer must remove secret values while preserving enough structure for reasoning. Placeholder substitution with a stable fingerprint lets the agent recognise that the same credential appeared in multiple places without exposing the value itself. Keeping URL schemes, usernames, and hosts intact also allows the model to understand error context and dependency relationships. This is a governance tradeoff: the system is designed to keep the investigation useful while eliminating the credential from model context and transcript reuse.

Practical implication: use deterministic placeholders so analysts can correlate incidents without reintroducing the secret.

What fail-open redaction means for control design

Fail-open redaction is a deliberate resilience choice. If the redaction layer breaks, the agent continues operating rather than taking the observability workflow down during an incident. That protects availability, but it also means the organisation must rely on monitoring, metrics, and policy caching to detect control degradation quickly. In practice, this shifts the control from a simple yes-or-no gate to a managed security service with health, auditability, and escalation requirements.

Practical implication: monitor redaction health continuously and alert on any category that stops filtering.

Threat narrative

Attacker objective: The objective is to obtain usable credentials from telemetry or model context and turn observability data into a live access path.

1. Entry occurs when an AI observability agent ingests logs, traces, and tool outputs that already contain bearer tokens, API keys, or database connection strings.
2. Escalation happens if the agent can send those values to a model provider before redaction or if a broken pattern leaves credentials visible in prompt context.
3. Impact is credential exposure at machine speed, where attackers or downstream systems can reuse the leaked secret for access, movement, or data theft.

Breaches seen in the wild

• CoPhish OAuth Token Theft via Copilot Studio — CoPhish campaign exploits Microsoft Copilot Studio agents to steal OAuth tokens via AI-assisted phishing.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Secret-bearing telemetry is now an access boundary, not just an operations artifact. When logs, traces, and tool results can contain bearer tokens or database credentials, any AI agent that consumes them becomes part of identity governance. The right control question is not whether the model is accurate, but whether the model ever sees material that should remain outside its trust domain. For IAM and NHI teams, this aligns directly with OWASP-NHI and NIST-CSF access control principles, because observability data can behave like a transient credential store.

Deterministic redaction is a better governance pattern than selective trust. The article’s placeholder approach keeps correlation possible while removing the value of the secret itself. That matters because incident response needs identity continuity across events, but security needs to prevent those same identities from being forwarded to a model provider. The named concept here is model-context secret leakage, and it describes the point where diagnostic data becomes externally processed identity material.

Fail-open controls are acceptable only when the organisation can prove detection and containment. A redaction layer that degrades gracefully avoids a hard outage, but it also creates an operational obligation to detect when the boundary has weakened. That makes the control closer to a managed security service than a static filter, with clear implications for audit evidence, monitoring, and response ownership under NIST-CSF and NIST-800-53.

AI observability vendors are inheriting a secrets-governance problem that IAM teams already understand. If the prompt can contain credentials, then model routing, tool output handling, and transcript retention all become identity lifecycle questions. The field needs to stop treating AI telemetry as a separate discipline and start treating it as an extension of NHI and privileged data handling, especially where machine identities and service credentials are embedded in operational workflows.

From our research:

• 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation.
• 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, showing how quickly exposure scales beyond manual review.
• Forward-looking, The 52 NHI breaches Report helps teams connect secret exposure to repeatable identity failure patterns across real incidents.

What this signals

Model-context secret leakage: AI observability introduces a governance pattern where telemetry becomes externally processed identity material. That means redaction must be treated like a privileged access control, not a post-processing convenience, and it should be evaluated alongside NHI governance, transcript retention, and model routing policies.

Teams should expect more controls to move from per-tool configuration to centralised boundary services as AI agents spread across observability, support, and engineering workflows. The practical implication is that IAM, PAM, and data security teams will need shared ownership of prompt inspection, audit evidence, and incident response for model-bound data flows.

For practitioners

• Redact before model routing Place the redaction layer in front of every model call, across every provider path, so no prompt leaves the environment with raw secrets intact.
• Walk the full conversation context Scan system prompts, agent replies, tool arguments, tool outputs, and nested JSON because secrets often appear several layers deep in telemetry.
• Use stable placeholders for correlation Replace detected secrets with deterministic fingerprints so analysts can link repeated exposure without restoring the credential value.
• Instrument boundary health and drift Track redaction counts, category-level failures, and policy-cache freshness so a broken control is visible before it becomes a disclosure event.

Key takeaways

• AI observability agents can turn ordinary telemetry into secret-bearing model context unless redaction happens before every model call.
• Deterministic placeholders preserve investigative value, but only if the control boundary is monitored and its failure modes are visible.
• For identity teams, prompt redaction is a secrets-governance problem that belongs in IAM, PAM, and NHI control design.

Key terms

• Model-context Secret Leakage: The exposure of credentials or other sensitive values inside the text sent to an AI model. It happens when logs, traces, tool outputs, or transcripts are forwarded without sufficient filtering, turning diagnostic data into a new disclosure channel.
• Deterministic Placeholder Redaction: A redaction method that replaces a secret with a stable token derived from the original value. It removes the usable credential while preserving enough identity for correlation, investigation, and duplicate-detection across repeated prompts or transcripts.
• Prompt Boundary Enforcement: Prompt boundary enforcement is the practice of inspecting AI prompts before they leave the browser or client application. It treats the prompt as a controlled data path, so secrets, PII, and other restricted content can be blocked, warned on, or logged according to policy before model ingestion.
• Fail-open: A fail-open system defaults to the safer operational state when it cannot trust its own conclusion. In a SOC, that means human review instead of auto-resolution. The control objective is to preserve uncertainty, evidence, and accountability when automation cannot reach a defensible answer.

What's in the full article

Edge Delta's full article covers the operational detail this post intentionally leaves for the source:

• Exact redaction placement across multiple LLM client stacks and provider routes
• The secret-pattern catalogue and false-positive handling rules used in the detection layer
• How placeholder hashing preserves correlation while hiding secret values
• Why fail-open behaviour was chosen for redaction outages and how policy caching limits disruption

👉 Edge Delta's full post covers the redaction architecture, failure handling, and detection boundary in more operational detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It gives practitioners a practical way to connect identity controls to the broader security workflows their programmes depend on.