Trellix Warns AI Agent Workflows Can Leak Credentials

Trellix says ordinary AI-agent workflows can move API keys and cloud secrets into logs, commands, and model context.

Trellix research published October 14 describes an architectural risk in which AI coding agents inherit developer privileges and can move credentials from protected stores into command arguments, shell history, logs, transcripts, files, or model context. Both reports cite ordinary workflows rather than a confirmed breach, including OAuth tokens placed in command-line arguments and agents reading .env files or cloud configuration. GBHackers specifically mentions a Microsoft Graph token in a curl Authorization header, AWS profiles, Kubernetes configs, and vault output, and maps the behaviors to ATT&CK T1552.001 and T1555.006 as overlap rather than evidence of compromise. Cyber Security News adds that Trellix groups the behaviors into ten classes, including unprotected SSH keys, and reports no malware, hashes, or malicious infrastructure. The sources agree on the core finding and differ mainly in examples and defenses: short-lived credentials, least privilege, filtering or redaction, restricted egress, approval gates, and linking credential use to the agent process instead of single alerts. Exposure depends on how the agents are deployed.

• Trellix published an October 14 analysis, covered on October 15, 2026, of an architectural risk in AI coding-agent workflows.
• Agents that inherit developer privileges can move API keys, OAuth tokens, and cloud secrets from protected stores into command arguments, shell history, logs, transcripts, files, or prompts sent to external models.
• Cited examples include a Microsoft Graph OAuth token in a curl Authorization header, reads of .env files, AWS profiles, Kubernetes configs, and cloud vault output, plus unprotected SSH keys.
• GBHackers says the behaviors overlap ATT&CK T1552.001 and T1555.006 without proving compromise; Cyber Security News reports no malware, hashes, or malicious infrastructure and says Trellix groups the behaviors into ten classes.
• Exposure depends on deployment. Suggested controls include short-lived credentials, least privilege, secret filtering or redaction, restricted egress, approval gates, and correlating related agent actions rather than alerting on single…