cs.CRSep 27, 2026

API Secrets Should Never Become Tokens in the LLM's Vocabulary: A Threat Analysis of API Credential Handling in LLM Agent Systems and an Empirical Evaluation of a Vault-Mediated Execution Boundary

Authors: Patrick Kenney, Hadi Ahmadi, Denis Lusson, Donald Nguyen, Gurbinder Gill

Organizations: Corvic AI Research

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Tool-using large language model (LLM) agents turn credential hygiene from a storage problem into an execution-security problem. A key pasted into a prompt, or embedded in a system prompt or tool configuration, crosses from an authentication boundary into a data pipeline, where it may persist in conversation history, logs, memory stores, generated code, and error payloads. Prompt injection and excessive agency then convert passive disclosure into unauthorized action. This paper formalizes the credential-exposure threat chain for agentic systems; synthesizes evidence from a platform secret-store incident, vendor-reported secret-sprawl measurement, and OWASP and NIST guidance; and describes a vault-mediated execution architecture in which the model selects a connector identifier while a trusted request boundary supplies authentication. We evaluate a production implementation, Corvic Security Vault, in two controlled black-box experiments. Across 16 probes spanning seven control domains, every probe met its expected outcome: an authenticated GitHub API request succeeded while the credential stayed absent from process environment values, caller-visible request headers, tested filesystem locations, three third-party echo services, and two unrelated API origins; both cloud instance-metadata endpoints were unreachable. We also report a negative result, a connector whose stored header mapping did not satisfy its provider's authentication contract, showing that centralized custody does not by itself guarantee correct configuration. Vault mediation removes several disclosure paths but is necessary rather than sufficient: least privilege, deterministic action authorization, human approval, telemetry redaction, and rotation remain independently required. The study is purposive and small, a functional security evaluation rather than a certification.

Figures & tables

Figure 1: The direct-paste anti-pattern. One introduction event creates several durable copies in systems designed for retention, any of which can later feed disclosure or misuse.
Figure 2: Vault-mediated execution. The agent names a connector; the trusted request boundary supplies authentication for the connector’s configured origin. The credential is never a value the agent holds.
E1: runtime exposure connector: FRED
declared origin api.stlouisfed.org
Probe setEnvironment variable names and values; the process environment file; 12 well-known credential paths; secret-mount globs; AWS IMDSv1 and GCP metadata endpoints; declared-host call; three echo services; two unrelated APIs
E2: host-bound function connector: GitHub
declared origin api.github.com
Probe setAuthenticated user endpoint; caller-prepared request headers; credential pattern scan over the environment; two echo services; one unrelated authenticated API
Table 1: Experimental design. Each experiment was granted a single connector identifier and issued a fixed probe set.
Control domainnnPassFail
Host-bound credential injection550
Process environment220
Filesystem mounts220
Cross-origin non-disclosure220
Credential non-observability220
Cloud metadata isolation220
Table 2: Evaluated probes by control domain. Rates are reported for completeness; per-domain nn ranges from 1 to 5 and no confidence interval is meaningful for this purposive design.
Figure 3: Evaluated probes by control domain, from experiments E1 and E2. Every probe met its pre-declared expected outcome. The result is a controlled functional check on a small purposive sample, not a statistical pass-rate estimate.
#ThreatBaseResid.
1Secret pasted into prompt254
2Indirect prompt injection2512
3Cross-origin credential exfiltration204
4Credential discovery in runtime204
5Over-privileged connector2015
6Long-lived token replay208
Table 3: Directional threat assessment. L×IL{\times}I is an ordinal prioritization score, not a probability.
Figure 4: Assessed change in ordinal priority score for the eight threats of Table 3 , sorted by residual score. Each pair joins the baseline score to the residual score after vault mediation, with the reduction annotated at right. Three threats remain at or near the high-priority threshold, so credential custody alone does not retire them.

Explore similar work

CardsList
Jun 2, 2026cs.CR

Caught in the Act(ivation): Toward Pre-Output and Multi-Turn Detection of Credential Exfiltration by LLM Agents

LLM agents often place sensitive credentials in the same context window as untrusted retrieved content, creating a direct path for indirect prompt injection to induce credential exfiltration. We study this failure mode through three complementary defenses. First, we ask whether activation probes can detect credential access before output tokens are emitted. Second, we construct honeytokens from format-specific character models and calibrate detection with split conformal prediction. Third, we treat multi-turn exfiltration as a cumulative information-flow problem and track an estimated leakage budget across conversation turns. In controlled experiments on open-weight models, activation features separate benign and credential-seeking prompts with high accuracy, including under held-out encoding transformations. In a small synthetic multi-turn suite, cumulative accounting detects attacks that per-turn detectors miss. These results are preliminary: the multi-turn benchmark is in-house and small, the activation method requires white-box access, and the information estimator provides a practical signal rather than a formal upper bound. Still, the results suggest that credential-exfiltration defenses should combine pre-output monitoring, calibrated canary detection, and temporal leakage accounting rather than relying only on text-level output filters.

Kargi Chauhan, Pratibha Revankar

University of California, Santa Cruz.

Indirect Prompt InjectionAttacker Large Language ModelLarge Language Model AgentsPreconditioner
AskPDF
Aug 11, 2026cs.CR

On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models

Large Language Models (LLMs) have undergone a shift from stateless conversational interfaces to autonomous agents capable of multi-step planning, tool invocation, code execution, and maintaining persistent memory. When these agents operate with real-world privileges---calling APIs, modifying files, and querying databases---a compromised reasoning step can trigger unauthorized data access, irreversible state changes, or cascading failures, yet the security research community has not kept pace. To quantify the state of the field, we conducted a systematic literature review under PRISMA 2020 guidelines across six databases, screening 743 records and retaining 85 papers (2023--2025) on agentic LLM security. Attack research outpaces defense work by 3.9:1. Perception-layer vulnerabilities (prompt injection, jailbreaking, adversarial perturbations) dominate, accounting for 66% of papers, while action-layer vulnerabilities (tool misuse, code injection, sandbox escape) appear in only 4.7%, misaligned with real-world risk. Code execution security accounts for 3.5%, and tool-augmented agents 12%. We contribute a four-layer taxonomy mapping 13 vulnerability types across perception, brain, action, and interaction layers, and identify seven open problems centered on containment. Agentic LLM insecurity stems from architectural coupling, where weak isolation allows vulnerabilities to propagate across layers.

Md Jafrin Hossain, Mohammad Arif Hossain, Nirwan Ansari

Florida International University, Miami, Florida, USA · Middle Tennessee State University, Murfreesboro, Tennessee, USA · New Jersey Institute of Technology, Newark, NJ, USA

Agentic
AskPDF
Jun 8, 2026cs.CR

SecureClaw: Clawing Back Control of LLM Agents

Tool-using large language model (LLM) agents face two distinct security failures: unauthorized external actions and exposure of sensitive plaintext inside the runtime before any final output check can intervene. Existing defenses usually protect one boundary, either the planner/runtime or the action sink, and therefore do not by themselves secure both surfaces. We present SecureClaw, a dual-boundary architecture that places authorization at the effect sink and plaintext confinement at the read boundary. Sensitive reads pass through a trusted gateway that replaces raw values with opaque handles and, in the evaluated deployment, bounded summaries as an explicit declassification interface. Writes that change external state follow a PREVIEW→\rightarrowCOMMIT protocol in which only a trusted executor may commit the exact canonical request authorized by policy. The runtime can still plan over summaries and symbolic references, but cannot directly dereference secrets or perform side effects. Across AgentDojo, AgentLeak, and Agent Security Bench (ASB), SecureClaw is the only defense we evaluate in a common harness that simultaneously retains usable task utility and achieves 0% attack success rate (ASR) on ASB, 0.64% ASR on AgentDojo, and 3.23% overall leak on AgentLeak's attacked parity lane, which measures final-output and internal-relay leakage.

Yuhan Ma, Stefan Schmid

1TU Berlin

OpenclawClaw-Like AgentLarge Language Model AgentsLeakage
AskPDF