← All guides · Reviewed November 2026
Agent Log Forensics: Finding Credential Grabs After the Fact
The short answer
Agent log forensics is replaying a recorded agent action log against declared rules to find boundary crossings you missed live. A credential grab — a logged action whose arguments touch password, API-key or private-key material — is one of nine patterns BoundaryVault's detector (rule version 2.0.0) finds after the fact, each with redacted evidence pointing at the exact action. Detector behaviour as shipped in BoundaryVault, November 2026. Run it on your own log with the free log scan.
What does the detector actually read?
Your log, in the shape agents already produce it: JSON entries carrying a timestamp (ts / timestamp / time), the agent (agent / agent_id), the tool called (tool / action / function) and its arguments (args / arguments / params) — plus, if you have one, a declared scope config naming the tools each agent is allowed to use. The scan is deterministic and declared-rule only: the same log under the same rules gives the same findings, which is what makes the result usable as evidence. The engine reads at most 50,000 actions in one analysis.
How is a credential grab recognised?
Two ways, either sufficient. By argument name: any argument whose name matches the credential family — password, passwd, secret, api_key, client_secret, private_key, access_key, auth_token, bearer, credential. By value shape: any argument value matching a known secret shape — the sk- key families, Slack-style xox tokens, AWS-style AKIA keys, GitHub-style ghp_ tokens, or a BEGIN PRIVATE KEY block. Values are also checked after decoding — base64, hex, URL encoding, reversed and chunked forms — because a grab that bothers to encode is still a grab. The finding itself never contains the secret: the evidence excerpt is redacted at detection time and capped at 240 characters.
What are the nine patterns?
| Pattern | Severity | What triggers it |
|---|---|---|
| credential-grab | high | Arguments touching password / secret / key material, by name or by value shape |
| token-forge | high | Token minting, refresh, key rotation or role assumption outside the declared auth flow |
| wallet-touch | high | Signing or transfer tools, seed phrases, private keys, wallet addresses |
| undeclared-egress | high | Sends to destinations outside the declared egress allowlist |
| privilege-escalation | high | Privilege granted beyond what was declared for the agent |
| handoff-crossing | high | Material handed to a receiver that may not hold it |
| crossing-chain | high | Acquire → transform → send-out sequences that compose into an exfiltration shape |
| scope-escape | medium | Any tool outside the declared allowed set — see what scope escape means |
| custom-rule | medium | Your own declared rules (Pro), matched against tool and arguments |
Pattern list and severities as defined in the detector, rule version 2.0.0, November 2026.
What do you do with a finding?
Each finding carries its rule id (bv-<pattern>-v2.0.0), severity, timestamp, action index, agent, tool and the redacted excerpt — enough to open your own log at that exact action and see what the agent did, in context. Confirmed grabs go on the rotation list first (the credential is rotated and the old value revoked), and the full set of findings becomes the disclosure packet if the incident needs one. The honest boundary, stated on every packet: known patterns via declared rules only — a clean scan is not proof of safety.
Run the free log scan · More agent-security tools from Ingenious AI
Frequently asked questions
What is a credential grab in an AI agent log?
A logged agent action whose arguments touch credential material: an argument named like a password, API key, client secret, private key, auth token or credential, or a value shaped like a live secret (for example an sk- key, an AKIA access key, a ghp_ token, or a BEGIN PRIVATE KEY block). BoundaryVault flags it as the credential-grab pattern, severity high.
How does BoundaryVault find credential grabs after the fact?
You paste the recorded action log — JSON entries with a timestamp, agent, tool and arguments, plus your declared scope if you have one. The deterministic detector (rule version 2.0.0) replays every entry against declared rules: secret-shaped values, credential-named arguments, token-minting tools outside the declared auth flow, tools outside the allowed set, wallet material, and encoded variants (base64, hex, URL encoding, reversed, chunked). Each finding points back to the exact action index and timestamp in your log.
Are the secrets in my log exposed in the report?
No. Every finding carries a redacted evidence excerpt (at most 240 characters) and secret values are never echoed — the excerpt shows the tool and argument names with values replaced by a redaction marker, so you can locate the action in your own log without the report becoming a second copy of the secret.
What can log forensics not find?
Novel exfiltration techniques and encodings beyond the named set are out of scope. BoundaryVault detects known boundary-crossing patterns via declared rules only — nine patterns in rule version 2.0.0 — and a clean report is not proof of safety, a limit stated in every disclosure packet the platform generates.
How much log can the free scan handle?
The free tier runs a single-log analysis of up to 200 actions per log, 10 analyses per day, with the full declared-rule detection (all patterns, chains, decoded secrets, egress, escalation, handoffs and the integrity audit) and a packet preview. Pro raises the cap to batch analysis of up to 10 logs at 50,000 actions each.