Skip to content
1Claw Academy
Curriculum/The AI Agent Threat Model2 minBeginner · Lesson 7 of 14

The context window as an exfiltration surface

Treat everything the model can see as already disclosed, and design credential handling around that.

A useful discipline: assume anything entering the context window has been published. Not because the model is malicious, but because too many paths lead outward for you to control them all.

  • The provider receives it as part of the request.
  • It may be retained in logs, traces, or debugging tools.
  • It can be echoed into a response, a tool call, or an error message.
  • It may persist into conversation history or long-term memory.
  • A future injection can ask the model to repeat it.
Watch out

That last one deserves emphasis. A secret pasted into context in turn 3 is still there in turn 40, when an injected instruction asks the agent to summarise everything it knows. Context is not scoped to the moment it was needed.

This is why pasting an API key into a prompt is categorically different from putting it in an environment variable. An env var is read by code that will not be talked into revealing it.

Three patterns follow directly, in increasing order of strength:

  • Reference, do not paste: put a path or an identifier in context, and resolve it outside the model.
  • Broker the call: the agent asks a control plane to perform an action; the credential is injected server-side and the agent sees only the result.
  • Redact on the way out: scan outputs for known secret values and replace them before they reach the model or the user.
Tip

Redaction is a backstop, not a primary control. It catches values you already know about; it cannot catch a credential it has never seen. Order these correctly: never rely on redaction to make an unsafe design safe.

The practical test for any agent design: if the model were asked to print everything it knows, what would appear? That output is your actual disclosure surface, and it is usually larger than the one you intended.

Check your understanding

3 questions
1

Why is a secret in context still at risk many turns later?

2

Which pattern is strongest for keeping credentials out of context?

3

What is the correct role of output redaction?