Trellix Research Reveals AI Agents Expose API Keys and Cloud Secrets
New analysis shows artificial intelligence agents can leak credentials during routine tasks, creating a hidden risk surface.
Key points
- Trellix researchers identify an "unseen credential surface" where AI agents expose secrets during normal operations.
- Credentials can move from protected storage into command histories, logs, and agent transcripts without malware.
- The study outlines ten classes of risky behaviors, including command-line credential exposure and weakened certificate checks.
Trellix published research on October 14 describing how artificial intelligence agents can inadvertently expose API keys and cloud secrets. The findings highlight a new security challenge where ordinary agent activities create an "unseen credential surface" that leaks sensitive data.
According to the report, these exposures occur during standard tasks even when no malware is present. Agents may retrieve credentials to complete work, moving data from secure stores into more visible locations like command histories or model contexts.
How Agents Leak Credentials
The risk emerges when an agent needs a credential to perform a specific function. For instance, an agent might retrieve an OAuth token from an operating system’s secure store and place it directly into a command-line argument.
That action makes the token visible to process-monitoring tools, other local processes, and shell history. If the agent records the command in its transcript or sends results to an external model provider, the secret may leave the device entirely.
Reading configuration files is another common exposure route. While a developer might inspect a file locally, an agent can pass its contents into the model context as part of the task. This includes reading .env files or cloud configuration data.
The same concern applies when an agent prints environment variables or uses command-line tools to retrieve credentials. Even if a cloud vault works as designed, exposure can happen after the agent retrieves the value and processes it.
Scope and Related Risks
Trellix groups these risky behaviors into ten distinct classes. These range from command-line credentials and credential-file reads to cloud secret retrieval, weakened certificate checks, and hidden command execution.
Other categories include changes to startup files and the creation of unprotected SSH keys. An agent might generate an unprotected key to avoid an interactive prompt, thereby increasing the attack surface.
Cyber Security News has previously reported on malware targeting local agent data, such as tokens and prompt histories. That malware could give criminals access to connected services, representing a separate but related threat vector.
The outlet also covered prompt injection attacks via GitHub comments, where untrusted text attempts to direct an agent with access to secrets. Both scenarios underscore the importance of managing agent permissions and stored data.
What should you do?
Organizations should review how AI agents handle credentials during routine tasks. Monitoring for unusual data movement from secure stores to transcripts or logs is essential. Teams must also evaluate the permissions granted to agents accessing cloud vaults or configuration files.
Background: Prompt injection attacks
Look for sudden shifts in tone, refusal to follow system constraints, or output that repeats hidden instructions. These signs indicate the model is processing injected commands rather than your intended query.
Read the full guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
What to do and how to stay safe: Trellix
- Audit agent configurations to ensure credentials are not passed directly into command-line arguments or model contexts.
- Monitor logs and transcripts for sensitive data that may have moved from protected storage to exposed areas.
- Restrict agent permissions to minimize access to cloud vaults, .env files, and other credential sources.
- Review startup files and SSH key generation practices to prevent the creation of unprotected credentials.
Step-by-step guide: Cloud Misconfiguration Response: Containment, Recovery and Prevention Steps
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Do AI agents need malware to expose credentials?
No, Trellix research indicates that agents can expose API keys and cloud secrets during ordinary work without any malware present.
Where do exposed credentials typically end up?
Sensitive data can move into command histories, logs, agent transcripts, and the model’s context, making it visible to various processes.
How many types of risky behaviors did Trellix identify?
Trellix grouped the risky behaviors into ten classes, including command-line credentials, file reads, and cloud secret retrieval.
