Detects known credential formats (AWS access key IDs, vendor API keys, GitHub tokens, SSH/PEM private key headers, JWTs, and similar) that appear in GenAI prompts or completions, or in strings flagged by the security_ai ML model as encoded payloads. The rule flags credentials exposed in model input (exfiltration risk) or in model output/encoded blobs (potential training-data leakage, context-window poisoning, or prompt-injection exfiltration). This supports immediate credential rotation and remediation, and correlates the event with invocation context to aid investigation. The rule analyzes multiple data sources (GenAI messages and security_ai-processed strings, plus relevant cloud-provider logs) and uses multi-pattern matching due to ES|QL regex limits. It includes a comprehensive triage guide, false positives guidance, and steps for remediation and root-cause analysis. MITRE mappings identify the technique as Unsecured Credentials under Credential Access, with corresponding MITRE ATLAS AML.T0055 coverage. High severity reflects the risk of credential exposure across GenAI invocations and the potential for broad impact if secrets are replayed or leaked into training data.