Agent tool output hygiene: when the agent's own tools leak secrets

Your agent ran git push, curl, and a quick env to inspect the environment — and every one of those commands sent its output straight into the agent’s context window, where it gets summarized and shipped to a model API. You didn’t paste a secret anywhere. The tools did it for you.

The tool output channel

When you type a command in a terminal, its output scrolls past and disappears. When an agent runs the same command, the output becomes part of its working memory — and a candidate for exfiltration. Tool output is one of the widest paths for secrets to leave your machine, and it is nearly invisible, because the leak happens in a place you never look: the stdout and stderr of ordinary commands.

Where the leaks come from

• Verbose and debug flags. curl -v prints request headers, including Authorization: Bearer <token>. A remote URL like https://user:token@github.com/... surfaces the token in git error messages and remote listings.
• Environment dumps. env, printenv, and set -x in scripts echo TOKEN=... values back to the agent. One debugging command turns your whole environment into tool output.
• Error messages. Services routinely embed URLs, access keys, and full connection strings in error text. An S3 client that prints a signed URL on failure has just handed the agent a working credential.
• Config and history files. Reading ~/.gitconfig, shell history, or .env files to “understand the project” dumps secrets into the window under the guise of harmless file reads.
• Encoded variants. The same value appears base64- or URL-encoded in logs, so scrubbing the literal string is not enough.

Why “the agent is trusted” doesn’t hold

None of this requires a malicious agent. It only requires a verbose tool and an instruction — from a webpage, a README, or a pasted snippet — to “show the curl command” or “print the environment.” Prompt injection turns routine tool output into an exfiltration channel, and the agent complies happily, because from its perspective it is just running a command. The asymmetry is structural: the agent treats tool output as ground truth about the world — which is what makes it useful, and exactly what an attacker exploits.

Practical hygiene rules

Treat every command an agent runs as a potential disclosure. The rules below are ordered: first stop the secret from existing in the clear, then stop it from reaching context, then stop it from leaving the machine.

1. Never put secrets in command lines. Use environment variables or stdin, not argv; process listings and shell history capture argv.
2. Strip before you send. Filter tool output for known secret values and secret-shaped patterns — including base64 and URL-encoded forms — before it enters the agent’s context.
3. Avoid dumping whole environments. Teach the agent to query specific variables rather than printing everything at once.
4. Redact at the egress too. A DLP layer on outbound model traffic catches values that slip past per-tool filtering.

Hygiene as a built-in feature

Tool output hygiene is easier when it is structural rather than habitual. This is the model built into trustless: a single-binary credential broker whose trustless run command injects secrets into a subprocess environment and sanitizes its stdout and stderr — including base64 and URL-encoded variants — so the agent only ever sees scrubbed output. The command reference is in the documentation.

Tool output is the channel most teams never audit. When did you last check what your agent actually sees when it runs curl -v?