Analysis
Joshua Mo: Your AI Agent's Secret Leaks Because You Fed It to the LLM — BigGo Finance
First reported · Discovered biggo.com
Page published
Earliest dated coverage: 11 Oct 2026 · First observed: 12 Oct 2026 · Latest dated coverage: 11 Oct 2026
Coverage timeline
Single-source analysis — one report is available.
Why it matters
Joshua Mo's analysis highlights a common architectural flaw in agent deployments—exposing secrets to the model and logging layers—that defenders should audit in credential and tool-call flows.
Venice AI's Joshua Mo argues on the AI Engineer podcast that most AI agents leak credentials because passwords and API keys are fed directly into the LLM context, where they can end up in training data, be exfiltrated via a single malicious tool call, or be logged by observability pipelines. He prescribes moving secrets into a deterministic execution layer, storing hashed identifiers, using split-key custody, and demanding hardware attestation, while conceding internet-enabled agents can still exfiltrate data through external APIs.