Secret Scanner Agent: Extracting Secrets and Access Context from Unstructured Documents

Source: arXiv cs.CR

Published: Mon, 13 Jul 2026 00:00:00 -0400

Summary

arXiv:2607.09011v1 Announce Type: new

Abstract: Exposed documents such as emails, chat threads, tickets, and incident notes routinely leak credentials, but during incident response a leaked secret is only half the story. Responders also need to identify the ``door'' the secret opens: the account, tenant, endpoint, database, cloud resource, or other system that the credential could allow an attacker to access. Traditional secret scanners rely on regular expressions or trained classifiers which work well on well-formatted code, yet they struggle when a credential is fragmented, reformatted, or far from the resource it unlocks, and they report the secret string without naming what it opens. We present Secret Scanner Agent (SSA), a multi-agent large-language-model system that extracts both the secret and its associated door, together with supporting evidence, from unstructured exposed documents. SSA pairs a detection agent that favors recall with a review agent that filters false positives and recovers missing context. Because real credential data is sensitive, we evaluate SSA on synthetic benchmarks we generated that span 23 secret types and multiple document formats, scored with a t

Sources

• Original publication on arXiv cs.CR
• arXiv cs.CR feed
• Lyrie research desk