Prompt-to-secret exfiltration is the path from injected text to credential disclosure. It occurs when malicious content convinces an agent to read, print, or forward a token it can access, turning a language interaction into a credential theft event.
Expanded Definition
Prompt-to-secret exfiltration describes an attack path where injected text persuades an agent to reveal credentials it can access. In NHI security, the issue is not just prompt injection itself, but the conversion of manipulated instructions into disclosure of secrets, tokens, API keys, or certificates. The boundary matters: a model can be vulnerable to prompt injection without any credential loss, but prompt-to-secret exfiltration exists only when the agent’s tool use, memory, or environment access lets the malicious prompt reach a secret store or a rendered secret value.
Definitions vary across vendors, but the practical control objective is consistent: the agent should not be able to expose secrets simply because it can read them. This is why the OWASP Non-Human Identity Top 10 treats secrets handling, privilege scope, and agent authority as separate security concerns. NHI Management Group also stresses that secret location and lifecycle discipline remain central, especially where long-lived credentials are embedded in workflows rather than isolated in dedicated vaults. The most common misapplication is treating all prompt injection as a secrets issue, which occurs when teams ignore whether the agent actually has permission to read or forward the credential.
Examples and Use Cases
Implementing defenses against prompt-to-secret exfiltration rigorously often introduces friction, because tighter tool permissions and secret isolation can reduce agent convenience and automation speed.
- A customer-support agent is tricked into echoing an API token from conversation memory into a reply, then the attacker reuses it for downstream access. This pattern is visible in supply chain incidents such as the Reviewdog GitHub Action supply chain attack, where exposed secrets became usable attack paths.
- An engineering copilot is instructed to inspect environment variables and print the value of a deployment secret. The risk is highest when secrets are stored in broadly readable runtime contexts instead of short-lived stores, a problem discussed in Guide to the Secret Sprawl Challenge.
- An autonomous agent with file-reading privileges is nudged to summarize a config file that contains tokens. The abuse works because the agent can access both content and credentials, not because the prompt alone has power.
- A CI assistant is persuaded to forward a credential from one tool output into another chat channel, creating an indirect exfiltration path similar to patterns seen in the Shai Hulud npm malware campaign.
- In federated agent workflows, a prompt can coerce one agent to request secrets from another, which is why the OWASP Non-Human Identity Top 10 emphasizes scoped, auditable access paths.
Why It Matters in NHI Security
Prompt-to-secret exfiltration is a governance problem as much as a technical one, because it exposes whether NHI permissions are bounded tightly enough for agentic use. Once an agent can read and disclose a token, every downstream system that trusts that token becomes reachable. NHI Management Group data shows that 96% of organisations store secrets outside of secrets managers in vulnerable locations, and 79% have experienced secrets leaks, with 77% of those incidents causing tangible damage. That combination makes disclosure through an agent not a theoretical edge case, but a realistic enterprise failure mode.
Practitioners should treat this term as a signal that secret placement, rotation, redaction, and least privilege are failing together. It also shows why a prompt filter alone is not a control: if the agent can access the secret, the attacker only needs one successful instruction. The Ultimate Guide to NHIs and the Static vs Dynamic Secrets guidance both point toward the same operational lesson: short-lived, scoped credentials reduce blast radius when an agent is manipulated.
Organisations typically encounter this consequence only after a model has already exposed a live token, at which point prompt-to-secret exfiltration becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Covers improper secret handling and exposure paths for non-human identities. |
| OWASP Agentic AI Top 10 | A-03 | Addresses prompt injection and unsafe tool actions in agentic systems. |
| NIST CSF 2.0 | PR.AC-4 | Least-privilege access control limits credential disclosure opportunities. |
| NIST Zero Trust (SP 800-207) | SC-7 | Zero Trust relies on minimizing implicit trust between workloads and data access paths. |
| NIST AI RMF | Risk governance requires identifying harmful model outputs and misuse paths. |
Restrict agent access to secrets, segregate storage, and log every retrieval or forwarding event.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 11, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
