Redact secrets from tool output
The agent can't leak what it never saw.
Most agent leaks need the agent to be holding the secret in the first place. If the tool that looks up an account returns recovery codes, the agent can be talked into sending them. If the tool returns the codes masked, the agent can be talked into sending an email and the attacker still gets nothing. In my lab this took the leak rate from 9 in 10 to zero.
If the helper never gets to see the secret, it can't give the secret away. So don't hand it the secret. Show it a version with the important part covered up.
How it works
- Find the tool that hands the agent the secret. In my lab it was the account lookup, which returned the customer’s recovery codes along with everything else.
- Change what the tool returns, not what the agent is told. The lookup now returns
ACME-RC-****-****where the codes used to be. The agent’s instructions don’t change at all. - Run the con again. The agent still believed the fake Security Operations note. It still wrote the email to the attacker and tried to send it. The codes weren’t in anything it held, so the attacker got a masked string.
This is the control I’d put in first, because it doesn’t depend on the model being smart. The model can be fully fooled and the secret still stays home.
What I measured
Redacted lookup output. Same agent, same attack, same cheap model, one change to the tool’s return value.
Removing the lookup tool entirely. The con still ran. There was no path to the codes.
Where it doesn’t help
If the agent needs the real value to do its job, masking it breaks the job. Then you’re into the next controls: a person before the send step, and an allow-list of where the data can go. And redaction covers one tool. An agent with five tools has five output shapes to look at.
The honest limits
Single-lab result, one afternoon, one vendor’s models. The zero is zero in my runs. It says the mechanism works, not that every redaction scheme is airtight.
Ask your team
- Which of our agent's tools return something we'd be upset to see in an email?
- Does the agent need that field to do its job, or just the record around it?
- Who owns the tool's output shape, and can they mask a field this week?