Credential Leakage

Credential leakage refers to the unauthorized exposure of authentication credentials such as API keys, passwords, tokens, or database connection strings, typically through code repositories, logs, or misconfigured systems. In AI governance contexts, this represents a critical security risk because compromised credentials can provide attackers with direct access to AI models, training data, and inference systems, potentially enabling data theft or malicious model manipulation. Organizations must implement automated scanning, secret management systems, and access controls to prevent and detect credential exposure before it can be exploited.

1 item

ResearchGlobal2026-08-11

Frontier API Reasoning Traces Leaked 62 Live API Keys in Public Agent Logs

Researchers from MATS Research, the ELLIS Institute Tubingen, and the Max Planck Institute for Intelligent Systems published findings showing that encrypted chain-of-thought reasoning blocks returned by Anthropic, OpenAI, and Google APIs can be replayed across sessions and users to extract hidden plaintext reasoning. Analysis of 6,708 publicly available agent trajectory logs reconstructed 315,320 reasoning blocks containing 704 distinct privacy artifacts, including 62 API keys, 33 passwords, and 24 access tokens. Sixty-four of those artifacts appeared exclusively inside reasoning blocks invisible to end users, meaning standard output-layer DLP controls would not have detected them.

Claude Opus Anthropic OpenAI Google DeepMind API risk credential leakage chain-of-thought model security