Encoded and obscured leaks
Agents pass each other base64 context blobs, hex identifiers, URL-encoded parameters and values split across messages. A detector that reads only plaintext misses every one. AgentLeak decodes what announces itself, and matches what does not against values the run already exposed.
The same 46 transformed copies (6 data types, 8 transformations) were run against the previous release and this one. A copy counts only when it is reported with the right type and the original value.
Base64, hex, URL-encoding and letter spacing decode to readable text or they do not, so they are decoded and read by the normal detectors. Reversal, ROT13 and splitting look like ordinary text, so they are only matched against values already seen in plaintext earlier in the run.
An encoded copy is attributed to the original value, so it raises exposure on its channel without inventing a second secret. A reversed SIN is the SIN, reversed, not some other SIN.
The mental model
A worker agent that receives a base64 blob decodes it in one call. So does anyone who reads the log it lands in. Treating the encoded form as safe is the same mistake as treating a hashed-looking identifier as anonymous: the recipient can read it, so it was disclosed.
The context blob passed between agents looks like noise to the audit, and the SIN inside it is never reported.
The blob is decoded, the SIN is reported on the inter-agent channel, and redact removes the whole token.
How it works
Nothing to enable. agentleak run reads decoded content with the same detectors, and reports a transform on each finding it recovered.
Each finding says how the copy was obscured: base64, hex, percent, spaced, reversed, rot13, split, or a chain such as base64>hex.
agentleak redact and agentleak proxy remove an encoded token whole, labelled by the most severe thing inside it.
scripts/encoded_leaks.py measures any installed version with the same method, so the before and after columns come from one script.
Measure it yourself
git clone https://github.com/yagobski/agentleak && cd agentleak
pip install agentleak
python scripts/encoded_leaks.py --installed
# agentleak 0.15.0 — 46 of 46 obscured copies detectedFAQ
Ready when you are
Create a local workspace, run a bundled scenario, then wire AgentLeak into CI or let your agent onboard itself.