How AI agents are leaking your secrets

Autonomous AI agents with full system access are being adopted at unprecedented speed. The OpenClaw ecosystem alone has over 300,000 GitHub stars, with users granting agents access to API keys, OAuth tokens, database credentials, and personal data. The security community has responded with supply chain scanning of agent skills (VirusTotal, Snyk, Cisco, Nvidia), but this focuses entirely on prevention. There is a blind spot on the output side: once secrets leave an agent's environment, nobody is systematically monitoring where they end up on the open internet. This presentation maps that attack surface using findings from BreachClaw, a live monitoring system that has been continuously scanning publicly accessible sources for AI agent secret leakage since March 2026.

The threat goes beyond theoretical risk. The ClawHavoc campaign saw over a thousand malicious skills targeting the OpenClaw ecosystem, exfiltrating credentials from agent configuration files and manipulating persistent agent memory. But malicious skills are only one leakage vector. Agents autonomously commit .env files and config dumps to public repositories, store plaintext credentials in memory and context files, and conversation logs capture secrets pasted by users. The result is a broad, systemic exposure problem, with leaked credentials surfacing across hundreds of unrelated repositories and multiple exfiltration channels. Organisations and individuals currently have no way to determine whether their AI agent usage has resulted in secret exposure.

The presentation covers the following topics:

1. The Output Side Attack Surface:​How autonomous AI agents create secret leakage vectors that traditional security tooling was not designed to detect. The multiple pathways from agent environment to open internet, including malicious skill exfiltration, misconfigured repositories, plaintext credential storage, and credential propagation across unrelated repositories. Why the industry's focus on supply chain prevention leaves this attack surface unmonitored.
2. What Is Leaking and Where It Surfaces:​Findings from months of continuous monitoring across hundreds of repositories, covering API keys from major AI and cloud providers, configuration credentials, passwords, JWTs, database credentials, PII, and private keys. Exfiltration channels observed in the wild, including paste sites, Discord and Slack webhooks, request bin services, C2 infrastructure patterns, and Telegram bot exfiltration.
3. Detection Methodology:​The three-layer approach used to identify real secrets at scale: pattern matching across multiple secret categories, deterministic heuristic filtering with an entropy aware rescue mechanism, and AI assisted review using Claude agents with human in the loop oversight. How this approach eliminates roughly three quarters of manual review workload.
4. What Works and What Doesn't in Secret Detection:​ Per category precision analysis showing that vendor specific patterns with unambiguous prefixes achieve significantly higher precision than generic patterns, which generate the majority of false positives. Practical guidance directly applicable to any organisation building or improving secret detection for AI agent deployments.
5. Defending Against Output Side Leakage:​Immediate actions for AI agent users and security teams, including credential rotation, configuration hygiene, skill auditing, and how to establish output side monitoring as part of an organisation's AI agent security posture.

​