What breaks when LLM credentials are passed directly through agents and applications?

Why This Matters for Security Teams

Passing LLM credentials through agents and applications turns a single secret into a distributed exposure problem. The credential can surface in prompt logs, retry queues, telemetry, memory, vendor connectors, and downstream services, which makes containment far harder than with a tightly scoped workload identity. That is why current guidance in the OWASP Non-Human Identity Top 10 and NIST AI Risk Management Framework pushes teams toward minimisation, traceability, and runtime control rather than secret propagation.

For autonomous or semi-autonomous agents, the issue is not only leakage but also reuse. A credential handed to one tool may be replayed by another tool chain, cached by an orchestration layer, or copied into a prompt where humans never intended it to live. NHIMG research on AI Agents: The New Attack Surface report shows that 80% of organisations report agents have already performed actions beyond intended scope, including revealing access credentials. In practice, many security teams encounter this only after an incident review exposes how broadly a single token had already spread.

How It Works in Practice

The safer model is to treat the agent as a workload with its own identity and to issue credentials only for the exact task, duration, and destination involved. That means replacing long-lived secrets with short-lived, scoped credentials and evaluating access at request time, not at build time. In emerging architectures, the agent proves what it is through workload identity, then receives an ephemeral token or delegated grant that expires when the task ends.

Practitioners usually combine four controls:

• Workload identity for the agent, such as SPIFFE-style identity or an OIDC-based assertion, so the system can verify the caller without embedding static secrets.
• Just-in-time credential issuance, so each action gets the minimum token needed for the minimum period.
• Policy-as-code for runtime authorisation, using context such as task intent, target system, and data sensitivity.
• Secret redaction and boundary enforcement, so prompts, logs, and traces do not become alternate storage locations.

This approach aligns with the direction set out in the OWASP Agentic AI Top 10 and the CSA MAESTRO agentic AI threat modeling framework, both of which emphasize reducing standing privilege and constraining tool use. NHIMG’s Ultimate Guide to NHIs — Static vs Dynamic Secrets is directly relevant here because the operational difference is simple: static credentials are portable, while dynamic credentials are bounded. These controls tend to break down when agents operate across loosely governed SaaS integrations and unmanaged prompt surfaces because the secret is no longer confined to a single trust boundary.

Common Variations and Edge Cases

Tighter credential control often increases orchestration overhead, requiring organisations to balance runtime security against latency, integration complexity, and operational maturity. There is no universal standard for this yet, especially where multiple agents share tools, or where legacy applications can only authenticate with long-lived API keys.

In these cases, current guidance suggests a staged transition rather than an immediate rewrite. One pattern is to wrap legacy secrets behind a broker that issues short-lived delegated tokens to agents, while the broker retains the original secret in a vault. Another is to separate read-only tasks from write-capable tasks so the agent never receives more privilege than the current action requires. The practical lesson is that direct credential passing should be treated as an exception, not a default integration pattern.

NHIMG’s LLMjacking: How Attackers Hijack AI Using Compromised NHIs shows why speed matters as well: exposed AWS credentials are often targeted within minutes, which makes secret sprawl especially dangerous in agentic pipelines. The same concern appears in the Anthropic report on AI-orchestrated cyber espionage, where tool chaining and automation magnified attacker reach. Teams that wait for perfect platform replacement usually discover the blast radius only after the first compromised token has already been reused across multiple systems.

Related resources from NHI Mgmt Group

• What breaks when AI agents are connected through personal accounts or shared credentials?
• What breaks when autonomous agents act through legitimate credentials?
• What breaks when secrets are passed through an LLM context?
• What breaks when AI agents are given access through ephemeral NHI credentials?