Trellix Research: How AI Agents Expose Enterprise Credentials

AI agents have quietly become one of the largest credential-handling systems in the modern enterprise, and they handle secrets in the least isolated way available.

Every AI coding or ops agent runs on a quiet assumption: that when it executes a command on your behalf, it treats credentials as carefully as a seasoned engineer would. According to new research from the Trellix Advanced Research Center, that assumption does not hold. The problem is architectural: agents constantly move secrets from encrypted stores down into plain-text command lines, shell history, local files and external LLM context windows, where they can be permanently logged by third-party model providers.

This systemic, accidental exposure is what Trellix calls the unseen credential surface. It is not a hypothetical future threat; it is how agents operate today, blending perfectly into normal developer workflows that EDR, SIEM and audit tools treat as routine.

What was announced

Trellix published a research report mapping how AI agents expose credentials across ten distinct behavior classes, each tied to MITRE ATT&CK and MITRE ATLAS techniques. The report introduces the concept of an isolation gradient, a ladder on which secrets live, from encrypted keystores at the top to external model providers at the bottom. Agents routinely push credentials down this ladder as a side effect of everyday tasks such as calling an API, reading a config file or running a migration.

The ten classes identified by Trellix include: credentials passed as command-line arguments, reading credential files such as .env or ~/.aws/credentials, extracting from OS keychains, harvesting environment variables, disabling TLS verification, off-machine egress via git or curl, obfuscated execution through base64 and eval, persistence through shell-startup files, bootstrapping new SSH keys with no passphrase, and extracting from cloud secret managers such as AWS Secrets Manager, Azure Key Vault, HashiCorp Vault and Kubernetes Secrets.

Why this matters

For CISOs, SOC leaders and IT directors, the research reframes agent security as a telemetry correlation problem, not a signature problem. The commands agents run are executed by the same signed binaries (curl, git, psql, kubectl, cat, node) that CI/CD pipelines and engineers use thousands of times a day. A single-event rule for reading a .env file or executing aws secretsmanager get-secret-value would bury the agent in a sea of legitimate activity.

Trellix also highlights the prompt-injection dimension: a poisoned README, web page or ticket can redirect an agent to perform exactly the same benign-looking actions against your production environment. Any machine running an AI agent should therefore be treated as high-value, secret-handling infrastructure.

Seen one event at a time, the credential surface stays unseen. Seen as a correlated sequence and kept off the exposed steps, it finally comes into view

Technical details

• Isolation gradient: five-step ladder from encrypted store to in-memory to command line to disk to off-machine egress, including transmission to the LLM provider.
• Ten exposure classes: mapped to MITRE ATT&CK techniques T1552, T1555, T1553, T1562, T1567, T1048, T1027, T1140, T1546.004, T1053, T1098.004 and T1555.006, and to MITRE ATLAS techniques AML.T0055, AML.T0057, AML.T0053 and AML.T0012.
• Context window exfiltration: every secret read by an agent is packaged into an API payload and sent to a third-party model provider, where it may be permanently logged.
• Trellix detection stack: Trellix EDR observes on-host activity, Trellix NDR inspects egress, Trellix DLP Endpoint tracks secret content in motion, and Trellix Wise AI correlates signals and attributes the chain to the originating agent process.
• Recommended architectural controls: short-lived OIDC or workload identity tokens, redaction before data enters the LLM context window, strict egress control, in-process credential brokering and separation of untrusted content from system instructions.

Softprom and Trellix

Softprom is the official distributor of Trellix. Our team helps enterprises deploy Trellix EDR, NDR, DLP Endpoint and Wise AI capabilities to correlate agent activity, catch cross-event sequences and shrink the blast radius of exposed credentials.

This content was prepared as part of the Softprom DistriFlow project — an automated system for monitoring and adapting vendor news. Original source: original article.