Secret theft is the unauthorized capture of credentials, tokens, keys, or certificates from systems, code, or memory. In this context, malicious packages may try to steal registry secrets, password material, or environment-stored access data. The impact can extend beyond one workstation if the stolen secrets unlock broader infrastructure.
Expanded Definition
Secret theft is the unauthorized extraction of credentials, tokens, keys, or certificates from code, memory, logs, build systems, or runtime environments. In NHI security, the term is narrower than general data exfiltration because the stolen asset is an authenticating secret that can be reused to impersonate an identity or toolchain component. The practical risk is that one exposed secret can create access far beyond the original host, especially when it belongs to a service account, CI/CD runner, or agent with wide permissions.
Usage across the industry is still evolving because some teams treat secret theft as a malware problem while others treat it as identity compromise. For operational clarity, NHI Management Group treats it as an identity event with security, governance, and incident response implications. The OWASP Non-Human Identity Top 10 places secret exposure and weak secret handling in the same risk family as over-privileged machine identities, which reflects how quickly theft becomes lateral movement. The most common misapplication is assuming a stolen secret is harmless if it was taken from a developer workstation, which occurs when the same credential is also trusted in production or automation.
Examples and Use Cases
Implementing detection and response for secret theft rigorously often introduces false positives and operational friction, requiring organisations to weigh automation speed against tighter inspection and revocation discipline.
- A malicious npm dependency reads environment variables during install and exfiltrates registry tokens, as seen in supply-chain cases discussed in the Shai Hulud npm malware campaign.
- A compromised GitHub Action scans repository secrets and pushes them to attacker-controlled infrastructure, a pattern highlighted in the Reviewdog GitHub Action supply chain attack.
- A CI/CD pipeline leaks cloud keys from logs or build variables, enabling the attacker to impersonate automation and modify infrastructure.
- A memory-resident token is harvested from an agent process after compromise, then reused to call internal APIs without prompting any human authentication step.
- static secret stored in code or config files are copied during repository access, which is why the Guide to the Secret Sprawl Challenge treats discovery and rotation as a continuous control.
Wherever possible, teams should compare these patterns with the Ultimate Guide to NHIs -- Static vs Dynamic Secrets, because the theft impact is very different when a secret is short-lived and scoped versus long-lived and reusable.
Why It Matters in NHI Security
Secret theft is one of the fastest ways to turn a minor compromise into a broad identity incident. NHI Management Group reports that 79% of organisations have experienced secrets leaks, and 77% of those incidents caused tangible damage, which shows that exposure is not a theoretical control gap but a repeatable path to loss. It is also consistent with the finding that 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools. That makes secret theft especially dangerous in NHI estates where service accounts, API keys, and certificates often carry privileged execution authority.
Governance failures usually appear first as weak inventory, weak rotation, and weak offboarding, then later as operational compromise. The issue is compounded when secrets remain valid after notification, because incident responders must treat theft as active access rather than historical exposure. Organisations typically encounter the real cost only after an environment-wide compromise, at which point secret theft becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Directly addresses secret storage, exposure, and misuse across non-human identities. |
| NIST CSF 2.0 | PR.AC-1 | Secret theft creates unauthorized access through compromised credentials and tokens. |
| NIST SP 800-63 | AAL2 | Secret strength and replay risk affect how authenticator assurance is sustained. |
| NIST Zero Trust (SP 800-207) | AC-6 | Zero Trust limits blast radius after a secret is stolen and reused. |
| NIST AI RMF | AI systems and agents can leak or misuse secrets through tool access and prompts. |
Inventory secrets, remove hardcoded credentials, and enforce rotation and vaulting for all machine identities.
Related resources from NHI Mgmt Group
- How should security teams reduce the risk of secret theft from npm supply chain attacks?
- What do organisations get wrong about AI developer tools and secret theft?
- Who is accountable when an agent skill install leads to secret theft?
- How can security teams reduce the impact of dependency-based secret theft?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
