The most instructive item in this month's data breach news was not a smash-and-grab. On October 21, 2026, a compromise of LiteLLM, the popular model gateway, caused GitHub OAuth tokens to be echoed into model response bodies. The tokens were then pulled from gateway logs: the log file itself had become the credential store.
BoundaryVault is Ingenious AI's scanner for agent action logs. It hunts boundary crossings in the record: credential grabs, token forges, scope escapes and wallet touches, and builds a disclosure packet. This audit turns the LiteLLM lesson on your own logging: what do your logs hold, and who can read them?
LiteLLM sits between applications and model providers, which makes its logs unusually rich: prompts, responses, and, it turns out, tokens. When the gateway was compromised, GitHub OAuth tokens were echoed into model response bodies and persisted in the gateway's logs. Anyone who later read those logs, attacker or investigator, found working credentials waiting.
The general lesson outlives the incident. Agent and gateway logs are where prompts, responses, tool arguments and, too often, credentials accumulate. Teams protect databases and vault secrets, then ship the same secrets into log storage with wide read access and long retention. The breach path runs through the record, not around it.
Because everything flows through them. Prompts carry user data, tool calls carry arguments, gateways carry tokens, and errors carry stack traces full of context. Logs aggregate all of it into one readable place, usually with the widest access and the longest retention in the stack. Attackers read them for the same reason engineers do.
Answer for the logs of your busiest agent or gateway. Everything runs in your browser; nothing is sent anywhere.
BoundaryVault, by Ingenious AI, scans your AI agents' action logs for boundary crossings and builds the disclosure packet, so the same record that could betray you becomes the record that defends you. See how BoundaryVault works.
1. What happened in the LiteLLM compromise of October 21, 2026?
2. Where were the exposed tokens recovered from?
3. Why are logs a breach surface?
4. What is the first fix when a credential has appeared in a log?
5. What should redaction act on?
A log token leak is the exposure of live credentials through log files: tokens, API keys or authorization headers written into prompts, responses, errors or debug output, then stored in log systems. The LiteLLM compromise of October 21, 2026 is the type case: OAuth tokens echoed into response bodies and recovered from gateway logs.
BoundaryVault scans agent action logs for boundary crossings: credential grabs, token forges, scope escapes and wallet touches. After a leak, that scan answers the investigator's question: did anything use the exposed access, and what did it touch? The output is a disclosure packet your team reviews before anyone else asks.
Through ordinary paths: gateways that log full requests and responses, error handlers that dump context, debug flags left on in production, and tool calls whose arguments include keys. None of these require an attacker. The defense is redaction before the write, tested with canary credentials that must never appear in storage.
A named few, reviewed on a schedule. Logs hold prompts, user data and sometimes credentials, so their readership deserves the same discipline as production data access. Map vendor-side access too: a support tool with log access is part of your readership whether it appears on your org chart or not.
Long enough to cover your slowest realistic dispute, investigation or audit, and no longer by default. Indefinite retention turns every logging mistake into a permanent exposure. Set the window deliberately, enforce deletion automatically, and keep the crossing-review habit inside the window while the evidence exists.
Sources: LiteLLM compromise reporting (October 21, 2026) · Ingenious AI unicorn-hunt record, agent-log token leak detector (October 23, 2026) · Ingenious AI unicorn audit of BoundaryVault (October 23, 2026).