Exposed AI credentials and secrets

What it is

AI systems hold many credentials: keys for model providers, tokens for the tools an agent calls, passwords for data sources. They accumulate in places that conventional secret management overlooks, including prompt templates, agent configuration files, experiment notebooks, and conversation logs that captured them in passing. A credential placed in a model's context should be assumed readable by anyone who can converse with the model.

How it happens

• A key is written into a prompt or tool definition for convenience.
• A notebook containing keys is shared or committed to a repository.
• Credentials passed in a conversation are stored in logs or memory.
• One long-lived key is shared by a whole team or by every agent.

Why it matters

A model provider key allows use at the organisation's expense and may expose stored conversations and fine-tuned models. A tool token gives whatever access the tool has. Because these keys are often long-lived and broadly scoped, one exposure reaches far.

Warning signs

• Secrets found by scanning prompts, configuration and notebooks.
• Keys with no owner, no expiry and no record of use.
• Provider usage from unfamiliar locations or at unusual times.
• The same key present in several systems.

Who owns it

Security owns the secret management standard and the scanning. Each system owner is accountable for the credentials the system holds.

In practice

A data scientist tests an idea in a notebook, pastes in the team's provider key, and later publishes the notebook to a public repository as part of a write-up. Within hours the key is being used by others, and the provider's invoice is the first sign. The same pattern generalises to any credential kept where the work is done instead of where secrets are managed.