Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

How Do Attackers Steal Credentials Through Prompt Injection?

They plant instructions in content an agent reads that tell it to collect a credential it can reach and send it out through a channel it can use. Check which of the lethal trifecta's three conditions each agent meets, and remove the credential first.

A credential reference travels from a browser record through a bounded route to a separate API destination.

Security teams that let an AI agent near credentials face an attacker who does not need to break anything to take them. The path has three steps, which the research describes in different words: an instruction arrives in content the agent reads, the agent reaches a value it was never meant to repeat, and a channel it is allowed to use carries the value out. At each step the defender has to answer what the agent held, what it could send and what the organization controls, and those answers set the organization's exposure. The evidence is the research on indirect injection and credential exfiltration, the OWASP entries for prompt injection and sensitive information disclosure, the design rules that Meta and the authors of CaMeL propose, and vendor documentation for coding agents and credential custody. The example is an environment variable carried out in a markdown image URL. How Does Prompt Injection Get Into a Coding Agent? covers how the instruction arrives, and Will Prompt Injection Ever Be Fixed at the Model Level? covers why the model alone will not close the path.

Key findings

  • Greshake et al. report attacks that "enable adversaries to remotely (without a direct interface) exploit LLM-integrated applications," so the attacker never touches the agent, only content it will read (Greshake et al. et al., 2023).
  • Danger arises when an agent has "Access to your private data," "Exposure to untrusted content," and "The ability to externally communicate," and even a request "to load an image" can carry stolen data (Willison, 2025).
  • Meta's rule is that "agents must satisfy no more than two of the following three properties within a session," which is a rule about removing one leg of the path (Meta AI, 2025).
  • OWASP warns that disclosure "can result in unauthorized data access, privacy violations, and intellectual property breaches" (OWASP, LLM02:2025, 2025).
  • A governed environment shows an agent tokens in place of the values on a page before any model reads the screen, so an instruction to collect a credential finds a token to collect (What Is Render-Layer Tokenization?).
  • An attack that succeeds against an agent working on tokens exfiltrates tokens, and a real value resolves only at the destination a person approved (What Is Least Exposure?).

What does a governed browser environment cover on the path from injection to theft?

A governed browser environment covers the part of the path that runs through a rendered page: the page the agent reads, the form it fills and the settings screen that shows it a value. The terminal, the IDE, the local filesystem, direct API calls and MCP are outside it, and several of the ways a credential is read, such as an environment variable or a configuration file, sit in that outside territory. Each step below says which side of the line it falls on, so that a reader can see where a page-level control applies and where another control has to carry the load.

The example record is an environment variable carried out in a markdown image URL. An agent reads a deployment settings page or a build log that shows the variable's value, a planted instruction tells it to add a status note with an image whose address ends in that value, and the client that displays the note requests the image, sending the value to the attacker's server. No password prompt appears and no file is copied. The data left as part of a page load. The record of a zero-click case shows the same mechanism: the exploit worked because the client "automatically fetches the external image URL included by the attacker" (What Is Indirect Prompt Injection and How Does It Reach AI Agents?).

What are the steps of the attack path?

The first step is delivery. Greshake et al. say such attacks "can act as arbitrary code execution, manipulate the application's functionality" (Greshake et al. et al., 2023), and a study of browsing agents reports "Our findings include prompt injection, domain validation bypass, and credential exfiltration" (Mudryi et al., 2025). The instruction can sit in a web page, an issue, a file or a tool result. The agent has no reliable way to tell it from the task.

The second step is reach. The instruction can only collect what the agent can already read, which makes the agent's access the variable that matters. OWASP's mitigation for prompt injection is a limit on that access: "Restrict the model's access privileges to the minimum necessary for its intended operations" (OWASP, LLM01:2025, 2025). In the example the value is on a settings page the agent was sent to read for a legitimate reason.

The third step is exit. The agent needs one channel to the outside, and many ordinary actions are one: a request for an image, a message, a commit, a form submission. The lethal trifecta (What Is the Lethal Trifecta for AI Agents?) names the three conditions together because each step needs the others. Remove any one and the path is cut. Of the three, the credential is the only one a defender can remove without removing the task.

Which channels carry a credential out of an agent?

The channel list is the list of things an agent is allowed to do outward. A request for an image is the quietest, since it looks like rendering and not like sending, and Willison's note that even a request "to load an image" can carry stolen data is the reason it heads the list (Willison, 2025). A commit or a pull request carries a value into a repository. A form submission carries it into another service. A direct request carries it to any address the network allows.

Controls on these channels exist and are partial. Cursor states that "By default, terminal commands need your approval" (Cursor, 2026), and MCP connections need approval as well. The same page describes run modes as "best-effort guardrails rather than a hard security boundary" (Cursor, 2026). Approval governs the command, and it does not show the person the value that will ride in it. A network layer is the other control: Firecracker states that "All egress traffic from a guest is therefore considered untrusted, and should be filtered at the host-level" (Firecracker, 2026), which filters where traffic may go and not what a permitted request carries. Each channel on this page is therefore bounded at one point, and none of the points is the value itself.

What do the vendors themselves say?

Cursor documents approvals for terminal commands and MCP connections, and its page does not describe how credentials are stored or protected. Firecracker documents egress filtering at the host and says nothing about credentials inside the guest. 1Password and Browserbase document keeping credentials away from the model for logins. What any of the three pages record about a value the agent reads on a page, a settings screen or a log is not described in the pages reviewed.

Dimension Vendor, per its documentation What a buyer should verify
Cursor, approvals "By default, terminal commands need your approval" (Cursor, 2026) Whether the person sees the values a command carries, not only the command
Firecracker, egress "All egress traffic from a guest is therefore considered untrusted, and should be filtered at the host-level" (Firecracker, 2026) What a permitted request may carry once the destination is allowed
Browserbase with 1Password, logins "Credentials are not shared with the LLM or exposed in Browserbase logs and repos" (1Password and Browserbase, 2025) The release covers logins and gives no technical detail on injection

Each row bounds an action, a destination or a login. None describes a control over which values the model reads on a page, which is the second step of the path.

Which step of the path can a defender remove?

Delivery is hard to stop, because the instruction looks like content. How Do You Protect AI Agents Against Prompt Injection? records that adaptive attackers have bypassed published model-level defenses, and advises protecting the architecture rather than the model. Exit is hard to close, because the task needs some outward channel. Reach is the step that can be cut cleanly: if the agent never holds the real value, there is nothing to send.

Design work points the same way. CaMeL's design goal is that "the untrusted data retrieved by the LLM can never impact the program flow" (Debenedetti et al., 2025), which keeps the instruction from steering the agent at all. Meta's rule asks a designer to choose which of the three properties to give up. In pipelines, OWASP advises teams to "Prefer using temporary credentials over static credentials" (OWASP, CICD-SEC-6, 2026) and to "Avoid sharing the same set of credentials across multiple contexts" (OWASP, CICD-SEC-6, 2026), so that a value that does leak is short-lived and useful in one place. The risk moment for an API key is often the one-time display on a settings page, which How Do You Let an AI Agent Manage API Keys Without Reading Them? takes up.

What does a governed environment change?

A governed environment is a control between a rendered page and the model. It substitutes consistent tokens for the values a policy names before any model reads the screen, so the agent works with KEY_001 and HOST_001 through the whole run. Real values resolve only at the approved destination, at the moment of an approved action, and a named person approves each consequential action. Every screen the agent saw as tokens, every action and every approval is written to an exported record that the organization's monitoring can hold.

Applied to the attack path, it acts on the second step. The instruction still arrives, and the agent may still follow it, but the settings page or log it reads shows tokens, so the image address, the commit message or the form field carries a token. The exit channel stays open and has nothing real to carry. A real value is used only where a person approved the destination, and that approval is on record.

The limits follow from the scope. The control covers the rendered page. An environment variable the agent reads through a shell, a file it opens in the tree or a direct API call is outside it, and the controls reviewed above, short-lived credentials, approvals and egress filtering, carry that part of the path. The two sets answer different questions. Those controls limit what an agent can do with a credential it holds. A governed environment limits what it holds.

Methodology and limitations

This page rests on research preprints on indirect injection, web agents and prompt injection defenses, standards guidance from OWASP, vendor documentation from Cursor, Firecracker and 1Password with Browserbase, practitioner and vendor analyses from Willison and Meta, and RedactSure's own research pages, each read for the facts recorded about that page. RedactSure's own pages are cited as its own statements, not as independent evidence. Vendor pages were read as of October 20, 2026, and each Sources line carries the date for its page. Quotations are attributed to the page they appear on, and a source is cited only for the facts recorded from it.

RedactSure did not test any agent, repository or browser hands-on, and nothing here reports a measured rate for credential theft by prompt injection. "Not described" means not described in the pages reviewed. The attack path is a structure drawn from the cited sources, and the markdown image example is a record type that the sources support through the trifecta analysis and the zero-click case, not a reproduced incident. Vendor features change and the page carries its date. RedactSure statements describe current design, and RedactSure is deploying now with enterprise and government customers. The example describes a record type, an environment variable in an image address, and not an organization.

Determinations about whether a configuration meets a legal or contractual duty belong to counsel, assessors and the organization's own security and compliance officers. A reader who needs one should treat this page as a reading list and a set of questions, and confirm each vendor statement against the current documentation before relying on it. Where this page says that a vendor does or does not describe something, it means the pages reviewed, on the dates shown.

What the record shows

Credential theft through prompt injection follows a path the research names in three parts: untrusted content that carries an instruction, an agent that can reach a value, and a channel that can carry it out. The vendor pages reviewed bound the third part and parts of the first: approvals, egress filtering, custody of logins, short-lived credentials. The pages reviewed record no control over which values the model reads on a page it opens. Cutting the middle step is the one change that does not depend on recognizing the instruction or closing every channel, so it is the control a security owner should ask vendors about first. A team can test its own exposure on one agent and one task, such as reading a deployment settings page, by listing which values on that page the model would hold and where an image address, a commit or a form could send them.

Frequently asked questions

How do attackers steal credentials through prompt injection?

They put an instruction in content the agent reads, such as a page, an issue or a file, and the instruction tells the agent to collect a credential it can reach and send it out. The agent follows because it cannot reliably separate the instruction from the task. Any ordinary outward action can be the exit. Write down which credentials your agent can read and which outward actions it can take, and compare the two lists.

Can a credential leave through an image?

It can. Willison notes that even a request to load an image can carry stolen data, because the address in the request can contain the value. A client that fetches the image automatically sends it without any action by the person. The same page-load mechanism is recorded in a zero-click case. Check whether your client fetches images from agent output, whether the destination is restricted, and whether anyone reviews the address before the request is made.

Does approving each command stop the theft?

It stops what the person notices. Cursor requires approval for terminal commands and MCP connections by default, and describes its run modes as best-effort guardrails and not a hard security boundary. A person approving a command sees the command, not the value it will carry. Approval is stronger when it covers the destination and the data together, so ask what the approver sees. A reviewer rarely notices a value tucked into an address.

Should credentials be short-lived?

Yes, as one control. OWASP advises temporary credentials over static ones and advises against sharing one set of credentials across contexts, which limits how long and how widely a leaked value works. A short-lived credential that the agent still reads is still read, and it can be used inside its lifetime. Pair expiry with a control on what the agent reads, and ask how quickly a leaked value can be revoked and who is told when it is used.

Does a credential manager solve it?

It solves the login. 1Password and Browserbase state that credentials are not shared with the model or exposed in logs, and the release gives no technical detail on injection. A settings page that shows an API key once, or a log that echoes a variable, is outside a login flow. The question to ask is where else the agent reads values once the sign-in has happened, such as a settings page, a build log or a copied configuration, and whether anything stands between those values and the model.

What should a team ask for in writing?

Four things: which credentials and values the agent can read in a run; which outward channels it can use, including image requests; whether a person sees the data a command carries as well as the command; and what the model receives from the pages it opens. The first three are settings a team can read today. The fourth is the one the vendor pages reviewed do not record, so ask for it in the vendor's own words and keep the reply with its date, so that a later change in the vendor's documentation can be compared against what was promised.

About the author

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

How RedactSure Keeps a Credential Out of the Model an Attacker Redirects

The attack path has three steps, and the controls reviewed filter what arrives and limit what leaves without changing the value the agent holds.

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Take an agent reading a deployment settings page that shows a variable's value, with an injected line asking it to add an image carrying the value in its address. Before: the model holds the real value, and the image request carries it out. Inside the governed environment: the model holds KEY_001, the address carries the token, and a real value resolves only at a destination a named reviewer approves.

RedactSure is deploying now with enterprise and government customers. Willison notes that even a request "to load an image" can carry stolen data.

Everyone else controls where data can go. RedactSure controls what the AI can see.

See it on your own workflow

Credential theft through prompt injection only works when the credential is already in the model's context. Bring a deployment settings task and see, with test values, what an injected image request would carry. Book a demo

Book a demo

Book a demo

Having trouble? Open the booking page or email us.