What breaks is the assumption that context is separate from control. If an agent can consume passwords, API keys, or other secrets from prompts and chat logs, the boundary between workflow data and privileged material disappears. That increases the chance of leakage, reuse, and unauthorized actions before any IAM review can intervene.
Why This Matters for Security Teams
When secrets appear in prompts or chat history, the problem is no longer just leakage. It becomes an authorization failure, because the agent can ingest privileged material outside normal secrets workflows and then act on it in ways defenders did not intend. That breaks separation between conversation context, application telemetry, and control-plane trust. Guidance from the OWASP Non-Human Identity Top 10 and NHIMG research such as The State of Secrets in AppSec treats this as a systemic exposure issue, not a simple hygiene issue.
The risk is amplified in AI-assisted workflows because chat logs are often retained, searched, forwarded, and summarized. A password that was meant for one task can be surfaced again in another context, copied into downstream tools, or embedded into agent memory. NHIMG data from the Guide to the Secret Sprawl Challenge shows how quickly secret exposure spreads across engineering systems once it leaves a managed vault. Current guidance suggests teams should assume anything present in prompts or history may be replayed by an agent unless it is explicitly excluded from the model’s reachable context. In practice, many security teams discover this only after an assistant has already echoed, reused, or exfiltrated a secret during routine troubleshooting.
How It Works in Practice
The practical failure mode is simple: the agent is given text, but that text contains material that should have stayed in a secrets store. If the system prompt, tool output, ticket, or chat thread includes an API key, token, certificate, or session secret, the agent can treat it as usable input rather than sensitive data. That makes the model a distribution channel for credentials, not just a consumer of instructions. The result is especially dangerous when the agent can chain tools, because a leaked secret can be replayed into cloud APIs, internal admin portals, or automation steps without a human noticing.
Effective controls start by preventing secrets from entering model-visible context at all. That means redaction before retrieval, prompt construction that excludes privileged material, and policy checks on both inbound and outbound content. Teams are increasingly pairing NIST AI Risk Management Framework principles with OWASP Agentic AI Top 10 guidance to enforce content filtering, least-privilege tool access, and runtime monitoring. The operational pattern is:
- store secrets in a vault, not in prompts, tickets, or chat transcripts;
- inject only short-lived values at execution time, then revoke them;
- scan retrieval sources and conversation logs for credential patterns;
- block agents from echoing or transforming sensitive material into other tools;
- log access to secrets as control events, not ordinary conversation data.
NHIMG’s Analysis of Claude Code Security is relevant here because code-assist and agentic workflows often blur the line between developer text and operational instructions. These controls tend to break down when legacy chat archives, shared incident channels, or RAG pipelines indiscriminately re-ingest historical messages because the model can only protect what it is not given.
Common Variations and Edge Cases
Tighter secret handling often increases workflow friction, requiring organisations to balance usability against exposure reduction. That tradeoff becomes visible in support desks, incident response rooms, and code-review assistants where teams want rapid collaboration but also need strict containment. Best practice is evolving, and there is no universal standard for how much historical context an agent should retain when sensitive material may appear in ordinary conversation.
One common edge case is partial disclosure: a prompt may contain a token fragment, masked credential, or reference that is enough for an agent to infer where a real secret lives. Another is cross-channel reuse, where a secret copied into chat is later surfaced by search, summarization, or memory features even after the original message is deleted. The danger is not limited to plain text either. Captured screenshots, pasted logs, and tool outputs can all carry secrets into the model context. NHIMG’s Moltbook AI agent keys breach and Reviewdog GitHub Action supply chain attack both reinforce a simple lesson: once secrets are placed where automation can read them, containment depends on memory discipline, retrieval hygiene, and immediate revocation, not on later IAM review.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 | Secret exposure in prompts often starts with poor rotation and reuse controls. |
| OWASP Agentic AI Top 10 | A2 | Agents echoing secrets is a prompt-and-context safety failure. |
| NIST AI RMF | AI RMF applies to managing leakage risk from model context and memory. |
Define governance to prevent sensitive data from entering agent context and retained memory.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on July 8, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
