risk
Credential and secret leakage through AI inputs, outputs, logs and generated code
API keys, tokens, private keys, and connection strings pasted into prompts, returned in outputs, hardcoded in generated code, or captured in conversation logs are exposed to unauthorized parties or persisted outside secret management, enabling account takeover and lateral movement.
Record JSON · Open in map · Data retrieval guide
Catalog revision: 24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028. A connection does not establish full coverage.
Attributes
- category
- ai_governance
- domain
- AI Governance
- Data Protection & Privacy
- Cryptography & Key Management
- taxonomy
- owasp-llm-top10-2025
- nist-ai-rmf-risk
- inherent_rating
- high
Details
- risk_id
- ai-secrets-credential-leakage
- category
- ai_governance
- likelihood
- medium
- impact
- high
- inherent_rating
- high
- treatment
- mitigate
- taxonomies
- owasp-llm-top10-2025
- nist-ai-rmf-risk
Source
No record-specific source URL is provided.
Connections
- UC-AI-18 — Defend AI interfaces against adversarial input, injection, and endpoint abuse mitigates Credential and secret leakage through AI inputs, outputs, logs and generated code
- strength
- related
- rationale
- Input screening is where pasted credentials can be caught before they reach the model or its logs.
- UC-AI-25 — Guide code-generating systems toward secure patterns and safe dependencies mitigates Credential and secret leakage through AI inputs, outputs, logs and generated code
- strength
- related
- rationale
- Guidance to reference secret managers rather than hardcode credentials keeps secrets out of generated code.
- UC-AI-22 — Prevent leakage of credentials and secrets through AI systems mitigates Credential and secret leakage through AI inputs, outputs, logs and generated code
- strength
- primary
- rationale
- Detecting, redacting, and safely storing credentials across prompts, outputs, logs, and generated code is the direct control for secret leakage.