LLMjacking shows how exposed NHI secrets can hijack AI systems

At a glance

What this is: This analysis examines how attackers abuse compromised non-human identities to hijack AI workflows and why exposed secrets, not prompts alone, create the real operational risk.

Why it matters: It matters to IAM and security teams because AI systems inherit the same credential, privilege, and lifecycle failures that already affect NHIs, service accounts, and delegated access paths.

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes.

👉 Read Reco AI's analysis of LLMjacking and compromised NHI secrets

Context

AI tool use becomes an identity problem when credentials, tokens, and delegated access are what connect the model to data and actions. In that setting, prompt risk is only part of the story because the surrounding NHI and access controls determine whether an attacker can turn a single weakness into unauthorized execution.

Reco AI's article uses the LLMjacking theme to show how quickly exposed machine credentials can be weaponised once AI systems are reachable through them. That starting position is becoming typical, not exceptional, because AI adoption is expanding faster than teams are hardening the secrets and service identities those systems rely on.

Key questions

Q: How should security teams handle exposed secrets in AI-driven environments?

A: Security teams should treat exposed secrets as active access paths and respond as though misuse can begin immediately. The right sequence is to identify the owning NHI, revoke the credential everywhere it is trusted, check downstream dependencies, and then validate whether the secret was copied into collaboration or CI systems.

Q: Why do compromised NHIs create extra risk for AI workflows?

A: Because AI workflows often rely on delegated credentials to retrieve data, call tools, or trigger automation. If those credentials are stolen, attackers inherit the workflow's trust boundary and can misuse it without breaking the model itself. That turns identity hygiene into an AI security control, not just an access-management task.

Q: What signs show that AI-connected credentials are being abused?

A: Look for unusual request sources, unexpected API call volume, connector activity outside normal schedules, and access to data sets the identity does not usually touch. Those signals matter because legitimate AI traffic can look automated, so anomaly detection must focus on source, scope, and timing rather than simple login failure counts.

Q: How do IAM and PAM teams split responsibility for AI agent access?

A: IAM should define what the agent can reach, while PAM should control when elevated access is available and how it is revoked. For AI agents, those responsibilities must be coordinated because programmatic identities do not fit a human session model. If scope and elevation are managed separately without a shared lifecycle view, privilege can persist longer than anyone expects.

Technical breakdown

How compromised NHI secrets become an AI access path

An AI system is rarely attacked through the model alone. In practice, the access path often runs through non-human identities such as API keys, service accounts, OAuth tokens, or cloud credentials that let the system retrieve data or call tools. Once those secrets are exposed, the attacker does not need to defeat the AI itself. They only need to use the same trust relationship the system already relies on. That is why AI security and NHI governance converge at the credential layer, not just at the prompt layer.

Practical implication: inventory the secrets and delegated identities that can reach AI workloads, then treat them as in-scope credentials, not background plumbing.

Why prompt controls do not stop context abuse

Prompt filtering addresses one input channel, but AI risk often emerges from the broader context stack. That stack includes retrieved documents, connected tools, permissions inherited from orchestration layers, and the memory or session state that shapes what the system can do. If an attacker hijacks that context through a compromised identity, the model may behave exactly as configured while still producing unsafe outcomes. The failure mode is governance blind spot, not model disobedience.

Practical implication: review tool permissions, retrieval scopes, and session boundaries together, because prompt controls alone do not constrain the full execution context.

Secrets exposure creates an operational race against attackers

The article's timing signal matters because exposed credentials are acted on quickly. That compresses the remediation window for AI-linked secrets, especially where tokens are long-lived, scattered across environments, or embedded in development and training workflows. The operational lesson is that rotation, revocation, and detection need to be continuous, because the attacker timeline is measured in minutes rather than days. In identity terms, standing access becomes the problem once secrets are discoverable at scale.

Practical implication: prioritise rapid revocation and short-lived credentials for AI-connected systems before any exposed secret can be replayed.

Threat narrative

Attacker objective: The objective is to convert exposed machine credentials into direct control over AI-connected data flows, tools, or decision paths.

1. Entry begins when attackers identify exposed AWS credentials, API keys, or other non-human identity secrets tied to AI-connected systems.
2. Escalation follows when those credentials are replayed to reach data, orchestration tools, or cloud services that the AI workflow depends on.
3. Impact occurs when the attacker uses that inherited trust to hijack the AI context, access sensitive data, or drive downstream misuse at scale.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Compromised NHI secrets are now an AI control-plane problem. When credentials, tokens, and service accounts sit behind AI workflows, the attacker does not need model access in the abstract. They need the same machine identity trust path that the workflow already uses. That means AI governance and NHI governance are now inseparable at the point of execution, not just at policy design. Practitioners should treat AI-connected secrets as control-plane assets, not implementation details.

Context, not the prompt, is where the security boundary has moved. The article's core insight is that prompts are only one input to an AI system, while the operational context includes retrieval sources, tool permissions, and delegated credentials. That makes the real failure mode a context trust gap, where the system can be manipulated without any obvious prompt anomaly. The named concept here is context trust gap, and it is becoming a defining risk for AI and NHI governance.

Short-lived access has to replace ambient replayability. When exposed AWS credentials can be attempted within minutes, long-lived secrets are no longer just inefficient. They create a replay window that attackers can exploit faster than many teams can observe and revoke. This strengthens the case for lifecycle controls, secret rotation discipline, and stronger scoping of AI-linked privileges. The security variable is not only whether access exists, but how quickly it can be invalidated.

AI security teams need a shared control model with IAM and PAM. The article reinforces that AI systems inherit ordinary identity failures, but they amplify them because tool access can be automated and reused at machine speed. That means identity review processes, privileged access controls, and credential hygiene all need to be extended into AI operations. The practical conclusion is straightforward: if a machine credential can reach the model, it must be governed like a privileged identity.

Attack speed is now part of the threat model for machine identity governance. The difference between exposure and exploitation can be measured in minutes, which changes how teams should think about discovery, alerting, and offboarding. Controls that rely on periodic review alone will miss the attack window. Practitioners should build governance around immediate revocation paths, not retrospective accountability.

From our research:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
• Exposure can become exploitation in as little as 9 minutes, according to the same Entro Security research, which leaves very little room for manual review.
• For a broader identity lens on machine access risk, see The State of Non-Human Identity Security for visibility, rotation, and confidence findings.

What this signals

Context trust gap: AI programmes are moving into a phase where the strongest control is not prompt filtering but the discipline around the identities, tokens, and tool paths that surround the model. Teams should expect this to pull IAM, PAM, and AI governance into the same operating model, especially where machine access can be replayed at scale. Reference models such as the NIST AI Risk Management Framework and the OWASP Agentic AI Top 10 are increasingly relevant here.

The practical signal for practitioners is that discovery and invalidation need to be measured in minutes, not review cycles. If secrets can be found and replayed faster than teams can revoke them, then the programme has a lifecycle problem, not a monitoring problem. That is where identity inventory, rapid offboarding, and secret containment become operational priorities rather than hygiene tasks.

AI security and NHI governance are converging into a single control question: who or what can reach the system, and how quickly can that access be removed? The organisations that answer that question well will be better positioned to govern agentic workflows, tool use, and machine identity sprawl without over-relying on the model layer itself.

For practitioners

• Map every AI-connected non-human identity Identify the service accounts, API keys, OAuth tokens, and cloud credentials that can reach AI systems, then classify them by privilege, lifespan, and revocation path.
• Reduce credential replay windows Move exposed or high-risk AI credentials to short-lived tokens, enforce rotation on a defined cadence, and automate revocation when secrets are discovered outside approved storage.
• Scope tool and retrieval permissions separately Review the permissions that let the model call tools, read data, and inherit session context, then remove access that is not required for the specific workflow.
• Add detection for credential reuse against AI services Create alerts for unusual token replay, impossible travel on cloud identities, and AI workload access from new geographies or unfamiliar automation paths.
• Extend privileged access review into AI operations Include AI-connected identities in PAM and access review cycles, with named owners, expiration dates, and documented offboarding procedures for every secret.

Key takeaways

• AI hijacking often starts with exposed machine credentials, not with a model-specific flaw.
• The 17-minute attack window shows that discovery and revocation speed are now core governance metrics for NHIs tied to AI.
• Practitioners need lifecycle control over secrets, tool permissions, and delegated access if they want to reduce AI context abuse.

Key terms

• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Activation Trust Gap: The activation trust gap is the difference between trusting data because it is protected and governing it because it is being reused. It appears when organisations move data from backup or archival systems into AI pipelines without reapplying access, sensitivity, and consumer controls.
• Credential Replay Window: A credential replay window is the period between secret exposure and successful revocation, during which attackers can reuse the credential. In machine identity environments, that window is often short and automated, so the practical risk is measured in minutes rather than review cycles.
• AI-connected Identity: An AI-connected identity is a non-human identity used by an AI application or agent to access data, tools, or services. It may be a service account, token, or API key. The governance challenge is that these identities can move data at machine speed and often outlive the review process built for humans.

What's in the full article

Reco AI's full article covers the operational detail this post intentionally leaves for the source:

• The article's example-based discussion of how compromised NHIs can be used to hijack AI workflows through exposed credentials.
• The specific attacker behaviour patterns observed around public AWS credentials and AI-linked secret exposure.
• The source's broader context on why prompt risk is secondary to credential and privilege context.
• The vendor's supporting examples of real-world exposure scenarios that help teams operationalise detection and response.

👉 Reco AI's full article covers the attack pattern, exposure timing, and AI hijacking context in more detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It is designed for practitioners who need to bring identity discipline into modern security programmes.