Skip to content

Hide Navigation Hide TOC

Bare Key Elicitation Token Detection - ATR-2026-02007 (c2dbe5ee-036c-5d5f-be70-a3d87c83d3dd)

Detects user turns that consist of nothing but a bare secret/credential label (e.g. "key:", "(key)", "[KEY]") with no surrounding sentence. This pattern is characteristic of elicitation probes where an attacker (or a compromised upstream agent) sends a minimal, whole-turn token designed to prompt the assistant to fill in a blank with a live secret, API key, or password rather than treating the message as a genuine question. Detection is whole-string anchored: it only fires when the entire user turn is the bare key/secret label itself, so ordinary sentences that merely mention "key" mid-conversation do not match. Multilingual coverage included (English, Spanish, French, German).

Cluster A Galaxy A Cluster B Galaxy B Level
Bare Key Elicitation Token Detection - ATR-2026-02007 (c2dbe5ee-036c-5d5f-be70-a3d87c83d3dd) Agent Threat Rules LLM Prompt Injection (19cd2d12-66ff-487c-a05c-e058b027efc9) MITRE ATLAS Attack Pattern 1
Bare Key Elicitation Token Detection - ATR-2026-02007 (c2dbe5ee-036c-5d5f-be70-a3d87c83d3dd) Agent Threat Rules Unsecured Credentials - T1552 (435dfb86-2697-4867-85b5-2fef496c0517) Attack Pattern 1
Bare Key Elicitation Token Detection - ATR-2026-02007 (c2dbe5ee-036c-5d5f-be70-a3d87c83d3dd) Agent Threat Rules LLM Jailbreak (172427e3-9ecc-49a3-b628-96b824cc4131) MITRE ATLAS Attack Pattern 1