Tool Response Credential Capture

Name: AI Agent Threat Matrix
Creator: OpenA2A
License: https://www.apache.org/licenses/LICENSE-2.0

Capture credentials returned in tool or API responses that pass through the agent's context

Tactic

Credential Harvest · Stage 3

Extract API keys, tokens, and credentials from agent context and connected services

Attack class

RETROACTIVE-PRIV

Exploiting previously granted access or cached credentials to gain unauthorized capabilities

Evidence grade

Validated

Reproduced in a controlled lab environment (DVAA) with documented steps.

DVAA validation

ToolBot credential responses

Reproductions in Damn Vulnerable AI Agent, the OpenA2A intentionally-broken agent for kill-chain validation.

Honeypot

AgentPwn coverage

Queued

In scope for honeypot observation; trap page or telemetry hook not yet built.

Capturing creds from a fake tool response needs an MCP fixture that returns secrets; not yet wired.

Detect

Live1 live · 0 queued

CRED-001

npx hackmyagent secure --ciLive = implemented in hackmyagent; queued = declared

Defend

Live5 live · 0 queued

Live = documented at oasb.ai; queued = declared

Reference

AI Agent Threat Matrix T-3003 (Tool Response Credential Capture). OpenA2A, 2026. https://threats.opena2a.org/techniques/T-3003