Secrets Management for AI Agents: Keeping Credentials Out of Configs and Prompts

Search your own machine for the last API key an agent used. It is probably in a settings file, an exported variable or a conversation you forgot. Any program with read access can see those places, and that now includes the agent, every tool it loads and the malware families that have started collecting agent data.

The plan below moves credentials out of those places without stopping the agent from working. The evidence base is GitGuardian's State of Secrets Sprawl 2026 report, Gen Digital's infostealer research, Knostic's guidance on coding agents, GitHub's OpenID Connect documentation and the OWASP non-human identity list. GitGuardian, Gen Digital and Knostic are vendors, so their numbers are vendor numbers, and nothing here promises that a leak cannot happen.

Where agent secrets actually hide

Five hiding places account for most findings. The first is MCP and tool configuration. GitGuardian counted 24,008 unique secrets exposed in MCP configuration files, and 14 percent of those leaked secrets were PostgreSQL connection strings (GitGuardian, 2026). The second is the agent's context. Knostic points out that ingestion happens silently, so developers seldom see which files an agent has absorbed, sensitive values included (Knostic). The third is prompt and conversation history, which Gen Digital says infostealer collection rules now target alongside tokens and MCP credentials, counting detections rather than infections (Gen Digital; more in the infostealer article). The fourth is collaboration tooling: about 28 percent of the secrets sprawl GitGuardian measured sat only outside code repositories, in chat and productivity tools (GitGuardian, 2026). The fifth is code the assistant writes, where the same report says commits co-authored by Claude Code leaked secrets at roughly twice the baseline rate, one vendor's measurement of public GitHub.

Scale matters too. GitGuardian reports 1,275,105 AI-service secrets exposed, up 81 percent year on year, the fastest-growing category it tracks (GitGuardian, 2026).

The identity angle

OWASP's non-human identity list lists four relevant entries: secret leakage (NHI2), long-lived secrets (NHI7), overprivileged NHI (NHI5) and NHI reuse (NHI9) (OWASP NHI Top 10). A credential in an agent file is a durable secret belonging to an identity that is frequently shared and too powerful. Better storage helps, yet the durable cure is holding fewer secrets in the first place. The identity guide explains how.

Fixes, ranked by payoff

Replace stored secrets with requested ones

Workload identity trades a platform-issued credential for a token with a short life, so no durable secret sits on disk. GitHub's OpenID Connect documentation describes the CI version: cloud credentials need not be copied into long-lived GitHub secrets, and each token works for a single job only (GitHub Docs). Cloud-hosted agents can follow the same route, as the workload identity article explains.

Route unavoidable secrets through a broker

If a secret cannot be avoided, have the agent fetch it when needed from a broker that gives a brief lease and records the request. Knostic suggests vault integration, rotation on short timers and on events, and automatic revocation once an agent strays outside its set boundaries (Knostic).

Split tokens by function

A token per role means one compromise can be revoked without stopping the rest. Narrow each by directory, time, environment or network where your platform can. OAuth for AI agents covers the patterns.

Keep keys out of configs and prompts

Put a named reference in the config and let the OS credential store or a broker resolve it at startup. Keep keys out of prompts; a pasted key means rotating it and deleting the conversation if you can. Scan configs for secrets before merging. Hand each MCP server only the variables it needs; the malicious MCP package teardown shows what one over-broad variable allows.

Guard the endpoint

Use the OS keychain, treat any local token file like a password, and store authentication material away from history files. Encryption at rest protects little when the key lies next to the data, a caution Gen Digital repeats (Gen Digital).

Scan beyond code, then act

Include chat, tickets and CI logs in scanning, since GitGuardian's measurement shows that scanning code alone misses a meaningful portion (GitGuardian, 2026). If an endpoint may be infected, revoke its sessions, replace the keys MCP connections use and review the apps linked to the account.

A rotation runbook to adapt

1. Trigger. Suspected leak, infected endpoint, departing owner, retired agent or the scheduled interval.
2. Locate. Enumerate each copy: config files, CI secrets, broker entries and chat records.
3. Replace. Mint a new credential at the same narrow scope, using a clean machine if an endpoint is suspect.
4. Cut over. Deploy it and confirm the agent still works.
5. Revoke. Disable the old one and check that requests using it are rejected.
6. Inspect. Read its latest activity for anything unexpected.
7. Log. Note date, owner and reason.

Try it first on a credential that does not matter, so that a real emergency feels familiar.

Make rotation work before scanning grows

Budgets usually flow toward detection. The GitGuardian report argues that detection is not the real constraint. It followed valid secrets found in 2022 and reports that 64 percent were still active four years later, since teams avoid rotating for fear of outages (GitGuardian, 2026). It adds that 46 percent of critical leaked secrets have no validation checker, so triage that relies on validity misses many of the worst cases.

Finding a leak and fixing it are different skills, and the second is rarer. A scanner raising a thousand alerts that nobody can resolve produces noise. The recommendation here is to build the rotation path first: a named owner per credential, a runbook that has been tried, and an application able to swap a credential without downtime. With that in place, detection pays off because each hit has an action attached.

Teams whose agents already run on short-lived federated tokens should spend differently. They have little durable material to rotate, so scanning for stragglers is the better spend. All of these figures describe public GitHub and one vendor's tooling, so test whether your own estate looks similar before shifting money.

When live secrets turn up

Production secrets discovered in agent configs or chat logs count as an incident. Call in the security team and the owners of the credentials, and think about a qualified responder to size the exposure if outsiders could reach them.

Open questions

• The number of agent products that now default to OS credential stores.
• How soon attackers put stolen agent tokens to use. Gen Digital documents collection, not abuse.
• How closely public GitHub numbers describe private estates.

Secrets and agents, briefly