Agentic secret scanning: when an LLM maps a leaked credential to what it unlocks

What is this?

On July 13, 2026, researchers published a preprint titled Secret Scanner Agent: Extracting Secrets and Access Context from Unstructured Documents (arXiv:2607.09011, submitted to CAMLIS 2026). The paper tackles a gap that every incident responder knows well: exposed artifacts — emails, chat threads, support tickets, incident notes — routinely leak credentials, but a leaked secret is only half the story. The other half is knowing which door that secret opens: the account, tenant, endpoint, database, or cloud resource an attacker could reach with it.

The work uses an LLM agent to do both jobs at once: detect the secret, and infer its access context from the surrounding text. It is a defensive research contribution, not an exploit. But it is worth reading precisely because the same capability is useful to whoever holds the documents — defender or attacker.

How it works

Traditional secret scanners — the kind wired into CI pipelines and code hosts — lean on regular expressions and trained classifiers to flag high-entropy strings and known token formats. That approach answers “is there a secret here?” but says nothing about “what would it unlock?” A responder is left correlating a flagged string against inventories by hand, under time pressure.

The agentic approach reframes the problem as reading comprehension over unstructured data. According to the paper, the agent ingests messy artifacts, extracts candidate secrets, and then reasons over the context around each one — the service being discussed, the environment named, the account or tenant referenced — to attribute an access scope to the credential. Prior work already showed LLMs outperform pattern matching on this class of task; a 2024 evaluation of secret-leak detection in issue reports found language models catch leaks that regexes miss because they read the sentence, not just the string. The 2026 paper extends that from detection to impact attribution.

The mechanism is not an attack. There is no payload here, and nothing about it depends on a flaw in a specific model or product. What it demonstrates is a shift in what is cheap to automate.

Why it matters

During incident response, blast radius drives triage. If a leaked key opens a read-only sandbox, you rotate it on a normal schedule; if it opens a production database or a cloud identity, you drop everything. An agent that estimates that scope directly from the leaking document compresses the slowest, most human part of the response loop.

That same compression cuts the other way. An attacker who exfiltrates a wiki, a ticket queue, or a chat export historically had to sift it for anything useful — slow, manual, and easy to under-exploit. An agent that reads the whole dump and hands back “here are the live credentials and here is what each one reaches” turns a pile of documents into a prioritized target list. This is the dual-use pattern the security field keeps meeting with agentic tooling: capabilities built for defenders lower the skill and time floor for offense at the same time. The paper does not release an attack, but the direction of travel is clear, and defenders should plan for it rather than be surprised by it.

Defenses

The controls that blunt this are unglamorous and well established — the agent just raises the cost of ignoring them.

• Keep secrets out of prose. Credentials in tickets, chat, email, and incident notes are the raw material here. Enforce that secrets live only in a vault, and scan documents and messaging platforms — not just code — for leaked material.
• Make leaked credentials worthless fast. Short-lived, automatically rotated, tightly scoped tokens shrink the window and the blast radius of anything an agent finds. A stolen credential is only as dangerous as its lifetime and its permissions.
• Least privilege, verified. Scope each credential to the narrowest resource set it needs, and audit for over-broad grants. “What does this unlock?” should have a small answer by design.
• Detect use, not just exposure. Alert on anomalous authentication and access patterns so that a credential which does leak is caught in use, independent of whether you spotted the leak.
• Govern the scanner itself. A secret-mapping agent is a high-value target and a concentrated store of sensitive findings. Run it under least privilege, log its access to the documents it reads, and protect its outputs as you would the secrets themselves.

Status

Item	Detail
Type	Defensive research (preprint)
Published	July 13, 2026 (arXiv:2607.09011, submitted to CAMLIS 2026)
Subject	LLM agent for credential detection + access-context attribution
Attack released	None — no payload or exploit
Risk class	Dual-use automation of credential blast-radius mapping
Relevance	Incident response, SOC automation, agentic AI tooling