Session context packs are convenient. They stuff recent files, tool outputs, and user notes into the next model turn. They are also a common place secrets leak: tokens pasted into notes, .env fragments in diffs, webhook signing keys in error text.
Treat context packs as untrusted for secrets. Keep credentials in a secret store the agent can request through a narrow tool, not in the prompt blob.
Scan packs for secret shapes before send
Before you attach files or tool output, run detectors for common key patterns and private PEM headers. Drop or redact matches. Fail closed on high-confidence hits. A missed detection costs less than a committed leak in logs and vendor prompts.
Combine this with secret rotation windows so a slip has a short useful life.
Give secrets a dedicated tool, not a paste path
Expose fetch_secret(name) with allowlists per agent role. The tool returns a short-lived value to the runtime, not to the model transcript when avoidable. If the model must see a value, scope it to the single call that needs it, then wipe it from later context.
This matches how you rotate API keys in agent sandboxes. Keys should move through controlled channels.
Strip error bodies that echo credentials
Upstream errors often reprint Authorization headers or connection strings. Cap and sanitize error text before it enters the pack. Prefer stable error codes in context. Keep raw bodies in a secured debug store outside the prompt.
Also verify callbacks the way you handle signing webhooks for AI callbacks. Signature secrets never belong in user-visible traces.
Separate system policy from user files
Keep policy and tool schemas in a stable prefix. Keep user files in a mutable section that is easy to scrub. When a secret appears, delete that section without rebuilding the entire agent stack. Mixing policy and user dumps makes redaction messy.
Stable prefixes also help caching. Unstable secret-stained packs thrash caches and raise cost, as covered in prompt caching cost traps.
Deny egress that is not on the allowlist
Even with clean packs, an agent can still exfiltrate if it can call arbitrary hosts. Default-deny egress and allow only the tool hosts you need, following sandbox egress allowlists for AI agents.
Secrets hygiene and egress control are one system. Either alone is incomplete.
Drill a leak response before you need it
Write a one-page playbook: revoke key, rotate, purge packs, notify. Run it once on a staged fake leak. Teams that only discuss leaks freeze when a real token shows up in a transcript.
Context packs should carry work, not credentials. If a secret can ride along by accident, redesign the path until it cannot.
FAQ
Why are context packs risky for secrets?
They collect notes, diffs, and errors that often contain tokens, then send that mix to models and logs.
How should agents access credentials?
Through a narrow allowlisted secret tool that returns short-lived values to the runtime, not through pasted files.
What should I do with upstream error text?
Sanitize and cap it before it enters the pack. Prefer codes in prompt context and keep raw bodies elsewhere.
How do I structure packs for easier redaction?
Keep policy and schemas in a stable prefix and user files in a scrubbable section.
Does egress control still matter if packs are clean?
Yes. Allowlists limit where an agent can send data even if a secret slips through.
What belongs in a leak playbook?
Revoke, rotate, purge packs, and notify, practiced once on a staged fake leak.