AI Agent Credential Broker Lab: Keep Tokens Out of Reach
This is a hands-on lab about where an AI agent’s credentials should live. Anything the agent can read, content that controls the agent can read too. You make 12 scored calls on environment variables, memory files, a broker, bound short-lived grants, scopes and what to do when you find tokens in the wrong place.
It is inspired by Salt Labs’ published Manus research, which Salt says showed one hidden email leading to code execution and connected-service tokens. Sources are listed below; the scenario is fictional. For other agent controls see the Agent Tool Scope Lab and the Agent Governance Plane.
You are Dana Whitfield, head of platform security at Northgate Logistics. Your teams have rolled out an AI agent called Relay that reads email, files and code on behalf of staff. A published piece of research (Salt Labs, on a different product) has shown how one hidden instruction in an email can end with code running in an agent's sandbox next to the tokens for the user's connected services. Over 12 scored decisions you decide where Relay's credentials live, what they are bound to, how long they last and what you do when you find them in the wrong place. Everything is invented and no attack steps appear. Each call scores 0 to 10 with the source behind the feedback.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
TL;DRWhat this is
5 points
- A scenario lab about one question: where do an AI agent's credentials live, and what can a prompt-injected agent read? You act as head of platform security at a fictional company.
- You make 12 scored decisions: credentials in environment variables, memory and files, a broker that makes the call for the agent, binding a grant to agent, initiating user, organisation and task, short lifetimes, read-only scopes, designing for an injection that gets through, connector token handling, cloud access, revoking what was exposed, the broker log and what you tell leadership.
- It draws on Salt Labs' published research on the Manus agent (Salt says one hidden email led to code execution and access to connected-service tokens, and that the flaw is fixed), OWASP guidance on excessive agency, the MCP security best practices and AWS, Google and Microsoft credential documentation.
- Free to play, no account needed. Every name, account id and host is invented. No attack steps appear and no real key is shown.
- Defensive and educational only.
How this differs from our other agent labs
The Agent Tool Scope Lab asks which tools an agent should have. This lab asks where the credentials behind those tools live and what each is bound to. The Agent Egress Containment Lab is about where data can go out; here the question is what is available to take.
The Subagent Delegation Trust Lab, Plugin Supply Chain Lab and MCP Rug Pull Lab cover trust between agents and connectors. This one covers the secret itself. For approvals on risky actions, try the Agent Step-Up Approval Lab; for stopping a run, the Agent Kill Switch Drill Lab.
Frequently asked questions
What is an AI agent credential broker?
It is a service outside the agent that holds the tokens for connected services and checks each request. The agent asks the broker to do an action; the broker decides, makes the downstream call and returns the result, so the agent never holds a long-lived secret. Where a token must reach the sandbox, the broker issues a short-lived one for the task. This is PlayCISO practice built on OWASP's advice to implement authorization in downstream systems rather than rely on the model.
What did the Salt Labs research on Manus show?
Salt says its researchers hijacked the Manus agent with a single email: hidden instructions, in an encoding that got past Manus's checks, led the agent to run attacker-supplied code in the user's cloud sandbox, where the sandbox could reach the Gmail connector's OAuth token and tokens for other connected services in environment variables. Salt says the flaw has been fixed and that its guardrail warned only after the code had run. The lab uses that story as a fictional pattern, not as a claim about any company you use.
Are short-lived tokens enough?
No. AWS documents temporary credentials as expiring in minutes to hours, which limits reuse, but a compromised agent can often ask for a new one. The lab teaches binding each grant to the agent, the initiating user, the organisation and the task, keeping scopes narrow and not letting the agent mint its own renewals.
Can a system prompt stop an agent leaking credentials?
Not on its own. OWASP notes that restrictions in a system prompt may not be honoured and can be bypassed by prompt injection. Take the secret out of the agent's reach instead of asking the agent to keep it.
Is the scenario based on a real incident at a company?
No. The organisation, agent, account ids and hosts are invented (the cloud account id is the one AWS uses in its documentation). The only real events referred to are named as research: Salt Labs' Manus write-up, dated 1 October 2026 on its page.
How is the lab scored?
Each of the 12 decisions scores 0 to 10 and the result is your share of the maximum, with a short band that says what the score means. The debrief shows the source behind each rationale. Lines labelled PlayCISO practice are our reasoning, not a statement by a source.
Sources
All read on 4 November 2026. Lines in the feedback marked “PlayCISO practice” are our own reasoning, not a statement by any source. The scenarios are fictional. We cite primary sources, not vendor advisories, and say where a page could not be fully read.
- Salt Security (Salt Labs): How we hijacked an AI agent with a single email (1 October 2026 (as dated on the page)) Research by the vendor Salt Security. Salt says the flaw is fixed; the page gives no dates for report, fix or vendor reply.
- OWASP GenAI Security Project: LLM06:2025 Excessive Agency (2025 edition)
- OWASP GenAI Security Project: LLM02:2025 Sensitive Information Disclosure (2025 edition) Gives general least-privilege guidance and lists security credentials as one kind of sensitive information; it has no credential-specific guidance.
- OWASP GenAI Security Project (Agentic Security Initiative): OWASP Top 10 for Agentic Applications for 2026 (9 December 2025 (as dated on the page)) The page describes the framework but our fetch did not return the ten entries, so we cite it as a framework and quote no individual entry.
- Model Context Protocol documentation: Security Best Practices (Current version on 4 Nov 2026)
- NIST: Zero Trust Architecture (NIST SP 800-207) (August 2020) We read the catalogue page and abstract only. We use it for the idea that network location or ownership grants no implicit trust and that access is decided per resource.
- AWS documentation: Temporary security credentials in IAM (Current version on 4 Nov 2026)
- Google Cloud documentation: Workload Identity Federation (Current version on 4 Nov 2026) Also read for the PlayCISO GCP labs on 4 Nov 2026; we cite it only for federation as an alternative to exported keys.
- Microsoft Learn: What are managed identities for Azure resources? (Page metadata ms.date 19 August 2025)
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.