🎯 Secret exfiltration

The items that name it 5

• [tl;dr sec] #352 - Unprompted Slides, AWS AI Post-compromise Trends, Malicious LLM API Routers
  articleas techniques2026-10-29

  Attack class by malicious LLM API routers: stealing credentials and keys sent through them.

• New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack
  writeupas classification.key entities2026-10-23
• M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions
  writeupas techniques2026-07-14

  Payload scanned the GitHub Actions runner environment for secrets and exfiltrated them to a rentry.co dead-drop URL.

• Pipelock
  repoas techniques2026-06-14

  AI agent with API key in environment leaks it via outbound request, e.g. curl to attacker-controlled domain

• Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain
  paperas techniquesIt is written here as Secret exfiltration (AC-2).

  Malicious router exfiltrates secrets/credentials from plaintext JSON payloads it has access to