Red-team lab / Failure patterns

Credentials or tokens within reach

Keys and tokens placed in prompts, configuration files or the agent's environment are one successful instruction away from being read out or sent somewhere.

Design it out

Keep credentials out of model context and out of the agent's reach: a separate service holds them and acts on the agent's behalf.

  • No credentials in model context API keys and tokens stay in the application; the model calls tools that use them.
  • No standing secrets for the agent The agent gets short-lived, task-scoped credentials instead of the developer's own keys and tokens.
  • Output secret scanner Block replies that contain known secrets in common encodings.

The agent design check flags it as: Credentials are within its reach.

Practise it

Where it happened

  1. · Research demonstration · Supabase MCP with Cursor (demonstration)The support ticket that read the tokens tableGive agents read-only, project-scoped access, and never a role that bypasses the database's own permission checks.
  2. · Incident · Amazon Q Developer for VS CodeA wiper prompt in a coding-agent releaseThe agent's own prompts and extensions are supply chain: review changes to them like code that can delete things, because it can.

Risk codes

  • LLM02 Sensitive information disclosure
  • LLM08 Hidden context exposure
  • LLM01 Prompt injection
  • ASI03 Identity and privilege abuse
  • ASI04 Agentic supply chain

MITRE ATLAS AML.T0024AML.T0136AML.T0077AML.T0069.002AML.T0084.001AML.T0083AML.T0051.000AML.T0051.001AML.T0054

OWASP Top 10 for LLM and Agentic Applications (2026) and MITRE ATLAS 2026.10, as mapped on By OWASP risk. My own mapping, not endorsed by OWASP or MITRE.

Next patternFound by its users, not by the team running it

Built with Llama