On 5 March 2025, researchers at Noma Security found that CrewAI, a platform for building and deploying teams of AI agents, was leaking one of its own secrets through an error message. When provisioning a deployment failed, the status check endpoint returned the full failure payload, and that payload included a repository clone URL containing an internal GitHub token. Noma said the token "was confirmed to have full administrative privileges across CrewAI's entire GitHub infrastructure," which would have let an attacker read or change all of CrewAI's private repositories, tamper with automation workflows and harvest further secrets. Noma reported the issue the same day, and CrewAI deployed a fix within five hours. Noma rated the flaw, which it named "Uncrew," at CVSS 9.2 and published its findings on 24 September 2025. No misuse of the token has been reported. Independent reporting on this finding is limited; this page relies on Noma's disclosure and one analysis of it.
Key takeaways
- A CrewAI error response exposed an internal GitHub token when deployment provisioning failed.
- The token had full administrative rights over CrewAI's GitHub organisation, according to Noma Security.
- With it, an attacker could have read and modified private repositories, tampered with workflows and harvested other secrets.
- Noma reported the issue on 5 March 2025 and CrewAI fixed it within five hours; no misuse was reported.
- The identity lesson: error handling is a secrets channel, and a single broad, long-lived token turns a small bug into a platform-wide exposure.
At a glance
| Organisation | CrewAI (AI agent orchestration platform) |
|---|---|
| When | Found and fixed 5 March 2025; disclosed by Noma Security 24 September 2025 |
| Attacker | None known. Found by Noma Security |
| Entry point | An error response from the deployment provisioning status endpoint |
| Identities abused | An internal GitHub token with administrative access to all of CrewAI's private repositories |
| Impact | Potential access to and tampering with CrewAI's source code and workflows; no misuse reported |
| Category | NHI, Agentic AI and AI agents. Incident class: confirmed NHI breach (live admin GitHub token exposed in an error response; found by researchers, no misuse reported) |
What happened
Noma Labs was reviewing CrewAI's platform, which organisations use "to orchestrate complex multi-agent workflows for business automation and decision-making processes." During provisioning, CrewAI polls a status endpoint, /crewai_plus/deployments/[deployment_id]/check_provision_status. "If the status is successful, the system continues polling; however, if a failure occurs, the backend returns an error containing the full JSON payload," which included an internal GitHub token. The token sat inside a repo_clone_url field.
The root cause, Noma wrote, was that "When the CrewAI platform encountered a failure during the provisioning of machines, it did not securely handle exceptions." The exposed token "wasn't a limited-scope credential, it was confirmed to have full administrative privileges across CrewAI's entire GitHub infrastructure." Noma listed what it could have enabled: cloning all private repositories, pushing malicious code or tampering with workflows, harvesting other secrets from repositories and configuration files, and supply chain attacks on CrewAI's users.
The response was fast. According to Noma's timeline, it discovered and reported the issue on 5 March 2025, and "within five hours of receiving the disclosure, the CrewAI team had deployed a security fix." Noma verified the fix and published its write-up on 24 September. Aembit later used the case to argue for short-lived credentials, noting that "A token with that scope operates as a privileged non-human identity."
Timeline
| Date | Event |
|---|---|
| 5 March 2025 | Noma Security finds the exposed token and reports it to CrewAI. |
| 5 March 2025 | CrewAI deploys a fix within five hours; Noma verifies it. |
| 24 September 2025 | Noma Security publishes its "Uncrew" disclosure. |
| 26 November 2025 | Aembit publishes an analysis of the case. |
How it happened: the identity attack path
- Powerful token in the backend. Provisioning used an internal GitHub token with organisation-wide admin rights.
- Failure path. When provisioning failed, the backend returned its full payload to the user.
- Secret in the response. The payload included a clone URL containing the token.
- Potential abuse. Anyone who triggered the error could have used the token against CrewAI's repositories.
- Fixed. CrewAI patched the issue within hours of the report.
Impact
- Potential: read and write access to all of CrewAI's private repositories and workflows.
- Actual: no misuse reported.
- Response: fixed within five hours of disclosure.
What this means for NHI governance
Two non-human identity problems combined here. The first was scope: a token used for provisioning had administrative rights over the whole GitHub organisation, far more than the task needed. The second was exposure: error messages and logs are rarely treated as places where secrets can leak, yet an unhandled exception returned the token to the user. Either on its own is common; together they turned a provisioning bug into a potential compromise of an AI platform's entire codebase.
AI agent platforms are especially sensitive because customers run their automation on them. Tokens used by these platforms should be short-lived, issued per task and scoped to one repository, and every response path, including failures, should redact credentials. See our Secrets Management Guide and NHI Authentication Guide.
Recommendations
- Redact secrets in errors and logs. Sanitise exception payloads before they leave the backend. See our Secrets Management Guide.
- Scope tokens to the task. A provisioning token should reach one repository, not the whole organisation. See the NHI Authentication Guide.
- Use short-lived credentials. GitHub App installation tokens expire and limit the damage of a leak. See the CI/CD Pipeline Identity Security Guide.
- Revoke and audit after exposure. Check repository access logs for use of the exposed token. See the Leaked Credential Response Playbook.
- Ask AI vendors how they manage their own secrets. Include credential handling in vendor assessments. See the AI Security Platform Buyer's Guide.
Frequently asked questions
What was the CrewAI "Uncrew" vulnerability?
A flaw in CrewAI's provisioning where a failed deployment returned an error containing an internal GitHub token with administrative access to all of CrewAI's private repositories. Noma Security rated it CVSS 9.2.
Was CrewAI breached?
A live admin GitHub token was exposed to anyone who triggered the error, which we treat as a breach. Noma Security found it and CrewAI fixed it within five hours of the report on 5 March 2025; no misuse was reported.
Why are error messages a secrets risk?
Unhandled errors often return internal data, such as configuration or request details, that can include credentials. Responses and logs need the same redaction as any other output.
Related NHI Mgmt Group resources
Deloitte Breach Claim 2025 · DeepSeek Database Exposure 2025 · Secrets Management Guide · NHI Authentication Guide · Leaked Credential Response Playbook
How NHI Mgmt Group can help
AI platforms run on powerful machine credentials. We help teams scope those tokens, keep them out of errors and logs and replace long-lived ones with short-lived credentials. See our NHI and AI agent security training.