Decoy credential
Also written honeytoken
A credential that looks real but is never used by any legitimate process — a fake API key, cloud key or token placed where an intruder or a misled agent would find it. Because nothing should ever touch it, any use is a high-confidence sign of compromise with almost no false positives.
How MoorAI handles it: moorai-honeytokens registers canaries stored only as a one-way hash; opt-in decoy AI keys, placed only by a signed policy and only in new files, are denied as Critical when they appear in a command, a tool's output or a model-proxy request.
See also living off the AI · non-human identity · data exfiltration
Related terms
-
Living off the AI
Attack concepts
An intruder who already runs code on a machine uses the AI tooling installed there — the coding agents, their API keys, local model servers — instead of…
-
Non-human identity
Agents & architecture
An identity used by software rather than a person — a service account, API key, OAuth token, certificate or workload identity — usually backed by a secret…
-
Data exfiltration
Attack concepts
Moving data the attacker should not have out to somewhere they control. In agent contexts the channel is rarely a file upload — it is a URL the agent is…
Defence & response
The vocabulary of running controls for agents: knowing what AI is present, cutting what it may do down to what it uses, catching misuse, and reconstructing an incident afterwards. Where MoorAI implements a term, a separate line under the definition says how; the definition itself stays vendor-neutral. To check one agent's configuration against these ideas, use the free permission right-sizer.