RFC 9700 is explicit: resource servers MUST never store or transfer access tokens in plaintext. Every production AI agent authenticating on your behalf violates that rule right now, not because of a misconfiguration, but because the architecture requires it.
Agent frameworks pipe stdout directly into the LLM context window by design. Debug logging, the mechanism by which agents receive tool execution feedback, accounts for 73.5% of credential leakage vulnerabilities (arXiv 2604.03070, 17,022 skills analyzed). The dominant leakage vector is the architecture itself, not a misconfiguration.
OAuth Was Designed for Programs That Hold Tokens Silently
RFC 6749 defines the Bearer token model: the token lives in memory or secure storage, sent in the Authorization header, never logged. RFC 9700 (Best Current Practice, January 2025) does not address non-human automated clients, and the guidance gap is explicit in the specification text.
In traditional applications, the token goes into an httpOnly cookie or the OS keychain. The application never sees it in plaintext. In agents, the token must appear in the context window for the agent to call APIs. It arrives as a tool call argument, a retrieved credential, or an environment variable that gets surfaced. There is no "secure storage" compatible with LLM context.
The structural incompatibility is direct: OAuth assumes a program that holds tokens silently. Agents require tokens in context to act.
Debug Logging Is the Mechanism, Not the Bug
arXiv 2604.03070 analyzed 17,022 agent skills. 520 contain credential leakage, producing 1,708 security issues across 10 leakage patterns. 73.5% are caused by debug logging.
The reason is architectural: frameworks like LangChain, AutoGen, and CrewAI pipe stdout into the LLM context window so the agent can see tool feedback. When a tool call includes an Authorization header, that header appears in stdout, which becomes context. This is not a bug in the framework; it is the intended feedback mechanism.
Three additional entry vectors feed the problem. Tool call results return auth headers verbatim (such as {"Authorization": "Bearer eyJ..."}), exposing tokens directly. Memory store documents that cached API responses with headers, and error messages from failed API calls that include request headers, complete the picture. 89.6% of leaked credentials are immediately exploitable.
Refresh Tokens Turn a 1-Hour Credential Into a Permanent Fixture
Access tokens carry a 1-hour TTL by RFC 6749 recommendation. An agent that leaks an access token gives an attacker a 1-hour attack window. Refresh tokens have no mandatory expiry: Google OAuth keeps them valid for 6 months of inactivity or indefinitely; Microsoft tokens are configurable, often permanent.
When an agent refreshes an access token, the stdout of that operation contains both the expired token and the new access token. The refresh token that authorized the exchange may also appear. If the agent's conversation history is stored for memory recall, both tokens persist indefinitely in the memory store.
The Salesloft-Drift incident (Obsidian Security) illustrates the scale: stolen Bearer tokens generated activity indistinguishable from legitimate agent activity across 700+ Salesforce environments. Refresh tokens stored in execution traces were extracted months after initial authorization. The time asymmetry is critical: an access token leak gives a 1-hour window. A refresh token leak gives an indefinite one.
Sub-Agent Briefing Is Credential Propagation
When an orchestrator delegates to a sub-agent, it passes context, including tool call history. That history contains every token that appeared in prior calls. arXiv 2605.05440 shows that authorization propagation in multi-agent systems occurs implicitly through context, not explicitly through delegation protocols. A sub-agent that should not have access to a credential receives it anyway as part of the inherited context.
Indirect prompt injection exploits this. An adversary who injects content into what the primary agent reads causes that content to appear in the sub-agent's context window alongside the credentials. arXiv 2606.04141 documents multi-turn cumulative leakage that per-turn monitoring does not detect. A single turn may contain a partial token; across 3-4 turns, the full credential is assembled. Standard per-request security scanning misses this entirely.
Standard Defenses Reduce Blast Radius, Not the Structural Problem
Token binding (RFC 8471) ties a token cryptographically to the TLS session. Serialization of the token into the agent's context happens before the network call. From that point, binding becomes irrelevant: the token is already exposed.
PAuth (arXiv 2603.17170, Microsoft Research) introduces task-scoped authorization via natural language slices. It achieves zero false positives and zero false negatives on the AgentDojo benchmark. It requires changes to authorization servers that no production OAuth provider had made as of 2025.
Scope minimization is correct practice, but it does not prevent tokens from appearing in debug output or tool call results. A read-only token that leaks still gives an attacker read access to every resource in its scope. arXiv 2609.00267 confirms the gap: no production multi-agent framework enforces explicit token delegation boundaries. All mitigation today is downstream of the leak.
Enforcement Controls Until Task-Scoped Authorization Ships
A few measures reduce exposure before PAuth or equivalent reaches production authorization servers.
Strip Authorization and X-API-Key headers from tool call results before adding them to context. Do this at the framework middleware layer, not in application code. Segregate refresh token storage from the LLM layer. The refresh step should happen in a sidecar process that returns only the new access token, never the refresh token. Use 15-minute token TTLs for agent-specific OAuth clients, not 1 hour.
Treat conversation history as a credential log: apply the same retention and access controls you apply to secrets files. The MAGO Intel tool (intel.mago.team) monitors agent execution traces for credential patterns. It detects when OAuth tokens or API keys appear in context, debug output, or memory stores before they propagate to sub-agents.
The authorization model for agents will not be solved by OAuth 2.1 or shorter token lifetimes; those address token interception, not token serialization. The fix requires task-scoped authorization where scope is implicit in the task description and expires with the task. Until PAuth or equivalent ships in production authorization servers, every execution trace in your agent pipeline is a credential log. Most teams are not treating it as one.
Top comments (0)