Token Leakage

Agents touch real systems, so real credentials flow near the model: API keys for tools, database connection strings, OAuth tokens. Token leakage is when those secrets escape. A key that lands in the model’s context can be repeated in an answer, a tool’s raw response that contains a credential can be shown to the user, and tracing can write secrets into logs in plaintext where many more people can read them.

The OWASP Top 10 for LLM applications covers the main routes. Its entry on system prompt leakage (LLM07:2025) says the system prompt should not be treated as a secret or used as a security control, and that credentials and connection strings should not be in it at all, because attackers can often infer or extract what it contains (OWASP, LLM07:2025 System Prompt Leakage). Its broader entry on sensitive information disclosure (LLM02:2025) lists security credentials among the data a model can expose through its output, and notes that instructions in the system prompt telling the model not to reveal data can be bypassed through prompt injection (OWASP, LLM02:2025 Sensitive Information Disclosure).

Observability is a route teams create themselves. OWASP’s Logging Cheat Sheet lists access tokens, session identifiers, passwords, database connection strings and encryption keys among the things that should usually not be written to logs directly, and should be removed, masked, hashed or encrypted instead (OWASP, Logging Cheat Sheet). AI tracing makes that harder because it often records full prompts, tool inputs and outputs. The OpenTelemetry conventions for generative AI warn that message content attributes are likely to contain sensitive data, and say that some content attributes should not be captured unless the user explicitly opts in (OpenTelemetry, GenAI attributes).

The defenses are ordinary secrets hygiene applied to a new data path. Keep credentials out of prompts, including the system prompt, and out of the model’s context entirely; let the tool layer hold them and pass the model a reference. Scope tokens narrowly under least privilege and make them short-lived, scrub tool responses before they reach the model or the user, and redact traces before storage. What is AI observability? covers what tracing records, and AI agent identity and permissions covers how agents should hold credentials.