Before you prompt AI to answer another question or perform another task, a Wake Forest computer scientist wants you to know it could expose your sensitive data.

Ying Zhang, an assistant professor in Wake Forest University’s Department of Computer Science, studies security in software engineering. Her latest research, “How Your Credentials Are Leaked by LLM Agent Skills,” explores how large language model (LLM) agents make data vulnerable to attacks.

• LLM agents are autonomous AI systems that analyze circumstances to plan and execute multi-step actions to achieve a goal. 
• A skill is a reusable software extension that gives an LLM agent new capabilities. By installing skills into LLM agents—like Claude Code, Codex or Cursor—developers can teach agents to perform specialized tasks, such as accessing a database or analyzing domain-specific information. 
• The credentials in danger of exposure include secret identification meant to allow two systems to talk together safely, without creating access to sensitive data. 

The exposure happens through the use of third-party AI agent skills. The tasks the skills perform could be anything from creating a presentation using your notes to scanning financial documents for compliance issues.

And, while credential leakage can happen either unintentionally or maliciously, the end result is the same—unauthorized access to private data, Zhang said.

When the agent skill is flawed or developed with malicious intent, it will steal your data and maybe pass it back to a remote server to be used in some malicious way.

Ying Zhang, Computer Science Department

Zhang, a corresponding author on the study, will present her research at the International Conference on Automated Software Engineering, Oct. 12-16 in Munich.

How do data leaks happen with AI agents?

According to Zhang’s research, these leaks happen in two ways:

• Malicious: When creating the skill, the developer includes instructions to steal your credentials and access your private data. 
• Unintentional: The developer doesn’t use secure coding when creating the skill, and unknowingly gives attackers access to credentials and data to exploit.

“A lot of skills have credential leakage problems, and there are also malicious skills being developed and distributed,” Zhang said. “Through our work, we are helping detect these skills and remove them from the open-source market.” 

How pervasive is this problem?

The research team behind this study used 17,022 randomly selected skills to create 170,226 outputs. They used skills available on SkillsMP, the largest open-source AI agent skill marketplace. It provides access to more than 1.6 million skills.

The researchers found:

• 520 affected skills.
• 1,708 security issues in those skills.
• 10 leakage patterns.

Moreover, 89.6% of leaked credentials were immediately exploitable.

When the researchers alerted SkillsMP to the problem, all malicious skills were removed, and most of the vulnerabilities created by negligent coding were fixed.

Why does it matter?

Zhang said the findings point to two problems in software development and AI: 

• Too many developers don’t know how to integrate security into their software. They lack knowledge in the security domain.
• Developers also tend to push out a product before giving security the consideration it needs. Zhang contends security should be part of planning from the start.

“When I train my students, I teach them that security is a critical component in their software design,” she said. “Every feature they develop, they have to keep security in mind.”

The rapid evolution of AI and the rise of AI-assisted software development called vibe coding makes securing people’s data even more important, she said. In this new era of software engineering, amateur developers don’t understand software security. And inexperienced developers can’t rely on AI to address security, either. 

What can stop the leaks?

More than anything, Zhang wants to see security intuitively integrated from the initial software design stage—not just after a breach. 

AI creates new security issues that developers and researchers must address, she said. Researchers need to devise a standard for data safety that AI developers must meet. Developers need a tool that analyzes AI agent skills for safety issues. And users could use assurances, in the form of a regulation or contract, that the apps they download are safe.