API Secrets Should Never Become Tokens in the LLM's Vocabulary: A Threat Analysis of API Credential Handling in LLM Agent Systems and an Empirical Evaluation of a Vault-Mediated Execution Boundary
Researchers show LLM agents can expose API secrets and evaluate a vault that keeps credentials outside the model.
Tool-using LLM agents can move API credentials from prompts or tool configuration into history, logs, memory, generated code, and error payloads, where prompt injection may turn disclosure into unauthorized action. The paper formalizes that chain and evaluates Corvic Security Vault, which lets the model choose a connector identifier while a trusted boundary attaches authentication. Across 16 black-box probes in seven control domains, an authenticated GitHub API request succeeded without the secret appearing in environment values, caller-visible headers, tested files, three echo services, or unrelated API origins. The authors report one misconfigured connector and say vault mediation is necessary but not sufficient.
- Credentials in prompts can persist in history, logs, memory, code, and errors.
- The model selects a connector ID while a trusted boundary supplies authentication.
- All 16 probes kept the GitHub secret off tested disclosure paths.
- One connector's stored header mapping failed its provider authentication contract.
- Least privilege, approval, redaction, and rotation remain independently required.
- Products
- Corvic Security Vault
From the original article
1 min read at arxiv.orgTool-using large language model (LLM) agents turn credential hygiene from a storage problem into an execution-security problem. A key pasted into a prompt, or embedded in a system prompt or tool configuration, crosses from an authentication boundary into a data pipeline, where it may persist in conversation history, logs, memory stores, generated code, and error payloads.
By Patrick Kenney · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.