Trellix warns AI agents expose credentials in normal use

Trellix argues that AI agents have quietly become a major and poorly protected handler of company secrets. The security firm’s November 2026 threat report calls this the “unseen credential surface”: passwords, keys and access tokens leave encrypted stores for more exposed places so that an agent can finish its task.

An AI coding or operations agent works in a loop. It writes a command, runs it, reads the output and writes the next one. To deploy code or call another service it needs credentials. Trellix describes those credentials turning up in command-line arguments, in files on disk and in the text sent to an external model provider, where the report warns they may be logged permanently.

None of this needs a malicious model or an intruder. Each step uses a trusted, everyday tool, so a command looks the same whether a developer, an agent or an attacker ran it. Trellix adds that prompt injection, where hidden text in a file or web page steers an agent, can turn the same abilities towards theft.

The firm recommends linking credential access, command execution and outbound network traffic back to the agent process that started them. It also recommends short-lived tokens that expire before a leaked copy can be used, keeping secrets off command lines, and tight limits on network access from any machine running an agent.

Trellix sells products that do this kind of monitoring, which is worth bearing in mind. Its argument rests on how agents are built, though, and that makes it easier to check than a forecast. Companies are buying agents as productivity software while giving them the access of a deployment system. Watch whether agent makers move credential handling out of the model’s view by default.

Sources: Trellix Advanced Research Center.