Notifications
Clear all
Topic starter
02/09/2026 1:29 pm
TL;DR: AI observability agents can expose bearer tokens, AWS keys, and connection strings unless every model call passes through a redaction layer, with placeholders preserving investigative value and fail-open behaviour protecting incident response, according to Edge Delta. The core issue is that telemetry already contains usable credentials, so agent prompts become a new secret-handling boundary.
NHIMG editorial — based on content published by Edge Delta: LLMjacking: How Attackers Hijack AI Using Compromised NHIs
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation.
Questions worth separating out
Q: How should security teams keep AI agents useful without letting them see secrets?
A: Use a credential broker or proxy so the agent can make authorised requests without ever handling the underlying tokens, API keys, or certificates.
Q: Why do AI observability workflows increase the risk of credential exposure?
A: Because observability data often contains bearer tokens, API keys, and connection strings that were never meant for model processing.
Q: What are the signs that redaction controls are failing in AI pipelines?
A: Watch for missing placeholder substitution, unfiltered secrets in repeated transcripts, category-specific scan errors, and stale policy states that outlive their source.
Practitioner guidance
- Redact before model routing Place the redaction layer in front of every model call, across every provider path, so no prompt leaves the environment with raw secrets intact.
- Walk the full conversation context Scan system prompts, agent replies, tool arguments, tool outputs, and nested JSON because secrets often appear several layers deep in telemetry.
- Use stable placeholders for correlation Replace detected secrets with deterministic fingerprints so analysts can link repeated exposure without restoring the credential value.
What's in the full article
Edge Delta's full article covers the operational detail this post intentionally leaves for the source:
- Exact redaction placement across multiple LLM client stacks and provider routes
- The secret-pattern catalogue and false-positive handling rules used in the detection layer
- How placeholder hashing preserves correlation while hiding secret values
- Why fail-open behaviour was chosen for redaction outages and how policy caching limits disruption
👉 Read Edge Delta's analysis of AI telemetry redaction and secret exposure →
AI telemetry redaction: what it means for model prompts and secrets?
Explore further
02/09/2026 1:30 pm
Secret-bearing telemetry is now an access boundary, not just an operations artifact. When logs, traces, and tool results can contain bearer tokens or database credentials, any AI agent that consumes them becomes part of identity governance. The right control question is not whether the model is accurate, but whether the model ever sees material that should remain outside its trust domain. For IAM and NHI teams, this aligns directly with OWASP-NHI and NIST-CSF access control principles, because observability data can behave like a transient credential store.
A few things that frame the scale:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation.
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, showing how quickly exposure scales beyond manual review.
A question worth separating out:
Q: Should organisations fail open or fail closed when prompt redaction breaks?
A: Fail open is defensible when availability matters during incidents, but only if monitoring, audit events, and cached policy state can prove the boundary is still under control. If the organisation cannot detect degradation quickly, fail-open behaviour becomes a disclosure risk rather than a resilience choice.
👉 Read our full editorial: How AI observability redaction changes secret exposure risk
