The context window is not a vault

Lesson 4 of 5 in Agent Identity, Auth, and Secrets.

There is one rule in this lesson, and everything else is engineering to satisfy it: no secret ever enters the context window. Not in the system prompt, not in a tool description, not in an example, not "temporarily for debugging", not base-64 encoded because that felt safer.

The reason is structural rather than a matter of care. The context window is the one place in your architecture where attacker-supplied text and your most privileged instructions sit in the same buffer, read by a component that cannot reliably tell instructions from data. Willison’s original 2022 framing was the SQL-injection parallel: applications assemble prompts by concatenating strings, so untrusted input mixed into a prompt can override developer instructions — and he later assessed a parameterized-query-style separation of instructions from data as extremely difficult, if not impossible with current LLM architectures.

So treat the context as readable by the attacker. Any string in it can be summarized, transformed, encoded, split across turns, or written into a tool argument that leaves your boundary. A key in the prompt is a key in the exfiltration path.

Anything in context can be exfiltrated by injection

The lethal trifecta (Willison, 16 June 2025) names three capabilities that, combined in one agent, let an attacker trick it into exfiltrating private data: access to private data, exposure to untrusted content, and the ability to communicate externally. A secret pasted into the system prompt is private data — you have pre-loaded leg one, permanently, for every session.

The trifecta post cites real exfiltration exploits reported and fixed against production systems including Microsoft 365 Copilot, GitHub’s official MCP server, GitLab Duo, ChatGPT, Google Bard and Slack. Willison is also blunt about the tempting shortcut: guardrail and detection products that catch around 95% of attacks are a failing grade in security, because an attacker retries. Meta’s Agents Rule of Two (31 October 2025) turns the same observation into a design constraint — until injection can be reliably detected and refused, an agent should satisfy at most two of: processes untrustworthy input, has access to sensitive systems or private data, can change state or communicate externally. If a task genuinely needs all three in one session, it should not run autonomously.

Containment, not detection, is the primary control. Keeping credentials out of the context is the cheapest containment you will ever implement.

Interactive sorting exercise: Where may an agent’s credential live? Sort each placement — the distinction that matters is whether a successful injection can read or redirect it.

AWS Security Blog — Securing AI agents with Amazon Bedrock AgentCore Identity (checked September 2026)

AgentCore Identity includes a token vault that stores OAuth 2.0 access and refresh tokens, API keys and OAuth client secrets, encrypted with AWS KMS keys (customer-managed keys supported), with native integration to AWS Secrets Manager. User-specific credentials are accessible only by the individual agent acting on behalf of the associated user.

Microsoft’s equivalent sits in the tool layer: a Foundry Toolbox provides centralized credential injection, token refresh and policy enforcement via Entra ID and OAuth identity passthrough, and Microsoft states that consuming agents do not manage per-tool credentials.

Both designs enforce the same invariant from opposite ends of the stack: the agent’s code — and therefore the model’s context — never holds the secret.

Rotation is the second half of secrets hygiene, and it is where the shared-account design fails hardest. If rotating a credential breaks six agents and forty integrations, rotation becomes a change-managed project, so it happens annually — or never — and every leaked copy stays valid for a year.

Invert it: make expiry the default and rotation the normal case. Prefer platform-issued credentials with lifetimes measured in minutes over any secret you store. For the secrets you must store, know four numbers per credential before launch: its TTL, its audience, its blast radius if leaked, and the wall-clock time to revoke it. That last one is the only one an incident cares about, and it is the one nobody measures — so measure it in a drill, not during the outage.

One more discipline that costs nothing: secrets have no business in traces either. Agent observability captures prompts, tool arguments and tool results by design; a token passed as a tool argument lands in your telemetry store, your dashboards and probably your third-party monitoring vendor. Redact at the boundary where the span is created, not later.

Myth: "It is fine, the key is in the system prompt and users never see the system prompt"

Users do not need to see it. The model sees it, and the model can be instructed by content it reads while working — a ticket, a web page, a retrieved document, a tool result. That is indirect prompt injection as defined by Greshake et al. (2023): malicious prompts planted in data the model is likely to retrieve. The attacker does not read your prompt; they ask your agent to.

Myth: "We hash or encode the secret in the prompt so the model cannot leak it"

If the secret must work, the plaintext exists somewhere in the request path. Encoding in the prompt only means the model can leak the encoded form and the attacker decodes it. Note the contrast with a legitimate encoding technique: Foundry’s spotlighting (preview) base-64 encodes third-party document content so the model treats it as less trustworthy — that is about marking untrusted input, not hiding secrets, and it is off by default and inflates token counts.

Myth: "Our agent needs a broad key because we do not know in advance which resources it will touch"

That is a statement about your tool design, not about credentials. If the set of reachable resources is unbounded, so is the blast radius of one injection. Bound it: enumerate the resource classes, mint per-class credentials at call time, and require an approval gate for anything outside the enumeration. "We cannot predict what it needs" and "least privilege is impossible here" are the same sentence, and both are design smells.

Fact: the vault is necessary but not sufficient

A vault removes standing secrets from code and context. It does not stop the agent from being told to use its legitimate authority badly — that is scoping, gates and egress control, covered in the tool-scoping module. Identity hygiene and authority scoping are two layers of the same containment stack; neither substitutes for the other.

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.