Agent uses a static, long-lived credential
ID |
agent-uses-static-long-lived-credential |
Severity |
high |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
OWASP LLM |
LLM02:2025 — Sensitive Information Disclosure |
OWASP ASI |
ASI03:2026 (Identity Abuse) |
Family |
LLM02 — Sensitive Information Disclosure |
Red-team vectors |
Credential Theft / NHI Abuse |
Tags |
ai_security |
Description
An AI agent / tool manifest hardcodes a static, long-lived credential — an API key, a bearer token, or a connection string with an inline password — with no rotation or secret-manager reference. A non-expiring credential in a manifest is a pre-staged theft target: once read (repository access, a leaked log, a compromised peer agent) it grants standing access to the backing service until someone notices and rotates it by hand.
The detector is anchored on agent/tool manifests (a tools: / agents: / connection_ref signal is
required) and obfuscates the matched secret before it enters the report. It is suppressed when the
value is a reference/placeholder (${VAR}, env:, vault:, {{ … }}, <…>) or the manifest
declares rotation metadata (credential_manager, ttl, rotation_policy, secretRef, valueFrom).
Examples
tools:
- external-api:
url: "https://api.example.com"
auth: "Bearer sk-live-1234567890abcdef" (1)
database:
connection_string: "postgres://user:s3cr3t@prod.db:5432" (1)| 1 | Hardcoded long-lived credential in an agent manifest — flagged. |
A value from a secret manager produces no finding:
tools:
- external-api:
auth: "${API_TOKEN}" # reference, not a literal
rotation_policy: "30d" # rotation metadata present