diff --git a/java/com.sap.sailing.aiagent/src/com/sap/sailing/aiagent/impl/AIAgentImpl.java b/java/com.sap.sailing.aiagent/src/com/sap/sailing/aiagent/impl/AIAgentImpl.java
index 884ad9719d5..a54c1723c1a 100644
--- a/java/com.sap.sailing.aiagent/src/com/sap/sailing/aiagent/impl/AIAgentImpl.java
+++ b/java/com.sap.sailing.aiagent/src/com/sap/sailing/aiagent/impl/AIAgentImpl.java
@@ -138,6 +138,10 @@ public class AIAgentImpl implements AIAgent {
                 chatSession = createChatSession();
             } catch (UnsupportedOperationException | URISyntaxException | IOException | ParseException e) {
                 throw new RuntimeException(e);
+            } catch (SecurityException e) {
+                aiCore.setCredentials(null);
+                logger.warning("Invalid credentials; clearing (setting to null).");
+                throw e;
             }
         } else {
             chatSession = null;
diff --git a/java/com.sap.sse.aicore/src/com/sap/sse/aicore/impl/AICoreImpl.java b/java/com.sap.sse.aicore/src/com/sap/sse/aicore/impl/AICoreImpl.java
index 82c1a93d339..e363065ea46 100644
--- a/java/com.sap.sse.aicore/src/com/sap/sse/aicore/impl/AICoreImpl.java
+++ b/java/com.sap.sse.aicore/src/com/sap/sse/aicore/impl/AICoreImpl.java
@@ -4,6 +4,7 @@ import java.io.IOException;
 import java.io.InputStreamReader;
 import java.net.URISyntaxException;
 import java.net.URL;
+import java.security.AccessControlException;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Optional;
@@ -123,8 +124,14 @@ public class AICoreImpl implements AICore {
     public JSONObject getJSONResponse(HttpUriRequest request) throws UnsupportedOperationException, ClientProtocolException, URISyntaxException, IOException, ParseException {
         final CloseableHttpClient client = getHttpClient();
         final HttpResponse response = client.execute(request);
-        if (response.getStatusLine().getStatusCode() >= 400) {
-            throw new IOException("Error fetching "+request.getRequestLine()+": ("+response.getStatusLine().getStatusCode()+") "+response.getStatusLine().getReasonPhrase());
+        final int statusCode = response.getStatusLine().getStatusCode();
+        if (statusCode == 401) {
+            throw new SecurityException("Authentication failed: "+response.getStatusLine().getReasonPhrase());
+        } else if (statusCode == 403) {
+            throw new AccessControlException("Authorization failed: " + response.getStatusLine().getReasonPhrase());
+        }
+        if (statusCode >= 400) {
+            throw new IOException("Error fetching "+request.getRequestLine()+": ("+statusCode+") "+response.getStatusLine().getReasonPhrase());
         }
         final JSONObject configurationsJson = (JSONObject) new JSONParser().parse(new InputStreamReader(response.getEntity().getContent()));
         return configurationsJson;
diff --git a/java/com.sap.sse.aicore/src/com/sap/sse/aicore/impl/CredentialsImpl.java b/java/com.sap.sse.aicore/src/com/sap/sse/aicore/impl/CredentialsImpl.java
index d50cdaea9d9..72a0ff75aab 100644
--- a/java/com.sap.sse.aicore/src/com/sap/sse/aicore/impl/CredentialsImpl.java
+++ b/java/com.sap.sse.aicore/src/com/sap/sse/aicore/impl/CredentialsImpl.java
@@ -6,6 +6,7 @@ import java.net.MalformedURLException;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.net.URL;
+import java.security.AccessControlException;
 import java.util.ArrayList;
 import java.util.List;
 
@@ -119,8 +120,14 @@ public class CredentialsImpl implements Credentials {
                 .build();
         final JSONParser jsonParser = new JSONParser();
         final HttpResponse response = client.execute(postRequest);
-        if (response.getStatusLine().getStatusCode() >= 400) {
-            throw new IOException("Error obtaining client token: "+response.getStatusLine().getReasonPhrase()+" ("+response.getStatusLine().getStatusCode()+")");
+        final int statusCode = response.getStatusLine().getStatusCode();
+        if (statusCode == 401) {
+            throw new SecurityException("Authentication failed: "+response.getStatusLine().getReasonPhrase());
+        } else if (statusCode == 403) {
+            throw new AccessControlException("Authorization failed: " + response.getStatusLine().getReasonPhrase());
+        }
+        if (statusCode >= 400) {
+            throw new IOException("Error obtaining client token: "+response.getStatusLine().getReasonPhrase()+" ("+statusCode+")");
         }
         final JSONObject tokenJson = (JSONObject) jsonParser.parse(new InputStreamReader(response.getEntity().getContent()));
         return (String) tokenJson.get(ACCESS_TOKEN);