Threat explainer
How attackers use AI agents to leak API keys, tokens, and credentials from your environment.
AI tools can read secrets. Attackers trick them into sending those secrets outside.
Secret exfiltration happens when an agent reads .env files, environment variables, or credential stores and passes them to external endpoints via tool calls, web requests, or log output.
HOL Guard turns these moments into private receipts first, then public lessons only after redaction and moderation.
Protect the coding tools your team already uses without forcing everyone to become a security expert.
Terminal-native coding agent with broad shell reach.
Open guideharnessAgentic coding harness with MCP and file access.
Open guideharnessIDE and CLI assistant across code and terminal flows.
Open guideharnessAI-first IDE with repo and terminal context.
Open guideReal protection moments, scrubbed for safety before becoming public learning pages.
A redacted example of a local secret read attempt.
Why it was risky
Env files often hold API keys or service credentials.
What Guard did
HOL Guard paused the read before file contents left the machine.
A redacted example of an MCP tool with a misleading description.
Why it was risky
The tool description asked the agent to read credentials and pass them as arguments.
What Guard did
HOL Guard paused the tool call and flagged the description for review.
A redacted example of a prompt injection via a file comment.
Why it was risky
The instruction was embedded in an HTML comment invisible to the developer.
What Guard did
HOL Guard paused the command and showed the source of the instruction.
A redacted example of a supply-chain attack via npm install.
Why it was risky
Postinstall scripts run with full permissions before anyone reviews the code.
What Guard did
HOL Guard paused the install and showed the script contents.
Practice attack patterns with static simulations. Nothing dangerous executes.
Secret exfiltration happens when an agent reads credentials or sensitive material and then exposes them through a tool, command, log, model request, or external destination. Coverage statements here are limited to the current HOL Guard support contract and do not imply universal model or harness protection.
Partially, and only at supported local action boundaries. HOL Guard can require approval for secret-bearing file/env reads it can see (for example .env). It is not a secrets manager, does not rotate tokens, and does not scrub secrets already inside model context. Secrets already exposed before Guard sees an action, and encrypted or unsupported egress paths, are out of coverage.
No. HOL Guard is local-first runtime control on the developer machine for shell, secrets/file reads, MCP server change, and plugin/skill install. It is not a secrets manager, vault, or DLP suite.
No. A scan is not a safety guarantee and cannot intercept runtime secret reads. The current public catalog scanner is registry-broker-fallback static scoring, not a live exploit test. Catalog plugin counts are not Registry Broker agent counts. Runtime benchmark fixtures are modeled, not live attack measurements.
Threat dossier · P1
Agents combine data access and action capability, allowing one influenced workflow to cross multiple trust boundaries.
Direct answer
Secret exfiltration happens when an agent reads credentials or sensitive material and then exposes them through a tool, command, log, model request, or external destination.
Coverage statements below are limited to the current HOL Guard support contract and do not imply universal model or harness protection.
Defensive model only. This sequence omits weaponized payloads and is not attributed to a specific incident unless a source explicitly says so.
Step 1
Agent gains access to a secret-bearing source.
Step 2
The secret enters model/tool context or process state.
Step 3
A command, tool, log, or network action attempts disclosure.
Step 4
Credential reuse can extend impact beyond the original session.
Policy pattern
Keep untrusted context or overbroad autonomy from becoming unconditional execution authority on supported action surfaces.
Use when: Agents combine data access and action capability, allowing one influenced workflow to cross multiple trust boundaries.
Step 1
Block further egress.
Step 2
Revoke and rotate affected credentials.
Step 3
Review where the secret was read and transmitted.
Step 4
Rescan/retest with synthetic secrets only.
Neighboring threat classes that share attack paths or trust boundaries with this dossier.