Tool Response Credential Capture
Capture credentials returned in tool or API responses that pass through the agent's context
Tactic
Credential Harvest (Stage 3)
Extract API keys, tokens, and credentials from agent context and connected services
Attack Class
RETROACTIVE-PRIV
Exploiting previously granted access or cached credentials to gain unauthorized capabilities
Evidence
Reproduced in controlled lab environment (DVAA) with documented steps.
DVAA Validation
Reproductions in Damn Vulnerable AI Agent, the OpenA2A intentionally-broken agent for kill-chain validation.
ToolBot credential responses
Honeypot Coverage (AgentPwn)
In scope for honeypot observation; trap page or telemetry hook not yet built.
Requires fake-tool fixture wired through MCP exploitation tier.
Evidence Source Breakdown
Evidence Timeline
HMA check CRED-001 failed on cred-test
HMA check CRED-001 failed on cred-test
HMA check CRED-001 failed on cred-test
HMA check CRED-001 failed on soc-demo
HMA check CRED-001 failed on opena2a-cli
HMA check CRED-001 failed on cred-test
HMA check CRED-001 failed on cred-test
HMA check CRED-001 failed on cred-test
HMA check CRED-001 failed on cred-test
Detection (HackMyAgent)
npx hackmyagent secure --ciLive = check implemented in hackmyagent; queued = declared, not yet implementedDefense (OASB Controls)
How to Cite
AI Agent Threat Matrix T-3003 (Tool Response Credential Capture). OpenA2A, 2026. https://threats.opena2a.org/techniques/T-3003