Why storing secrets in AI agent context windows is a serious security risk

Developers commonly embed API keys, passwords, and auth tokens directly into AI agent prompts or context windows so agents can function, but security experts warn this practice is dangerous. The context window — the text a model reads to determine its actions — can be manipulated through prompt injection, ranked as the top risk for LLM applications by OWASP. An attacker who plants text in external content processed by the agent, such as a web page or document, can instruct the model to reveal any credentials it can see. The recommended fix is to keep secrets in an execution layer outside the model, where code attaches credentials only when making actual calls, while the agent merely signals intent. Developers are also advised to expose narrow, scoped tools instead of raw credentials, rotate secrets regularly, and filter sensitive data from tool responses before returning them to the model.