Secret Key Exfiltration Request - ATR-2026-02017 (8337f6a2-3ec9-53ec-99ea-dce5ea6cda92)
Detects user-turn prompts that name a secret, remembered, or hidden key and immediately qualify it with an exfiltration cue (asking for its value, demanding it verbatim, or requesting it without translation/additional text). Commonly paired with a fake "end of task" or role-reset framing to make the agent treat a prior system/session secret as safe to disclose. Narrowed to require the qualifying cue directly after the key mention so it does not fire on bare "SECRET_KEY" mentions common in benign env-var/config documentation (23 benign hits observed on the unqualified pattern during tuning). Also matches the literal {$SECRET_KEY} placeholder-leak pattern. Best applied to user-input/ llm_input channel, not tool_response/docs content.