Your Secrets Manager Ends Where the Context Window Begins
Your vault does everything right. Secrets are encrypted at rest, access is logged, rotation is automated, and nothing ever touches disk in plaintext. Then your agent calls a debugging tool, the tool prints an environment dump to stdout, the framework helpfully feeds stdout into the model's context — and your database credential is now part of a prompt. From that moment, the vault's guarantees are fiction. The credential exists in the trace your observability platform captured, in the prompt cache your provider keyed on that prefix, in the memory store your agent writes to between sessions, in the eval fixture someone snapshotted from production traffic, and in the provider's retention logs. Five persistence layers, none of which your secrets manager knows exist.
This is not a hypothetical. A large-scale study of over 17,000 published agent skills found that information exposure through logging accounted for 73.5% of all credential security issues — dwarfing hardcoded secrets at 18.2% — precisely because agent frameworks capture console output directly into the LLM context window. The old failure mode was a developer committing a key to GitHub. The new one is a tool response committing a key to a context window, and the context window has no git revert.
