Office Hours — Should you give AI agents access to API keys and private credentials, and if so, what isolation strategies actually work?

Should you give AI agents access to API keys and private credentials, and if so, what isolation strategies actually work?

Short answer: yes, but you need multiple layers. A single isolation strategy will fail.

Start with the assumption that your agent will leak credentials. Design around that.

The practical stack looks like: credential vaults (HashiCorp Vault, AWS Secrets Manager) that issue short-lived tokens, not long-lived keys. Agent gets a 15-minute token scoped to specific resources, not your entire S3 bucket. When the token expires, the agent can’t use it anymore even if it’s cached in memory or logged somewhere.

Second layer: network isolation. Run the agent in a container or VM with an egress allowlist. It can only talk to specific endpoints. No exfiltrating credentials to attacker infrastructure even if it wanted to.

Third layer: audit logging on everything the agent does. Not just what it outputs, but every API call it makes, every file it reads. When (not if) you find credentials in logs, you catch it fast and can revoke that token immediately. This also gives you the forensic trail to understand what happened.

Concrete Example: Scoped Token Pattern

Here’s what this looks like in practice. Instead of handing Claude Opus 4.7 your AWS root credentials, you issue it a temporary STS token:

aws sts assume-role \
  --role-arn arn:aws:iam::123456789012:role/agent-codegen \
  --role-session-name claude-session-$(date +%s) \
  --duration-seconds 900 \
  --tags Key=model,Value=claude-opus-4.7

The role agent-codegen has exactly one inline policy: push to a specific repository and read from a narrowly scoped S3 prefix. That’s it. The token expires in 15 minutes. If the agent is running Claude Code or Cursor Agent and the token leaks in a debug log, an attacker gets 15 minutes of access to that specific repo, not your entire infrastructure.

Compare that to the alternative: handing the agent a personal access token valid for 90 days with full repository access. One leaked token and you’re rotating credentials org-wide.

The hard part is that agents need some credentials to be useful. Claude Code, Cursor Agent, and Devin all handle this differently. Some use OAuth flows where they never see the secret directly. Some use temporary credentials that rotate aggressively. The framework you pick matters.

Don’t use the agent’s own token budget to authenticate itself. Separate concerns. The agent should authenticate via a service account that only has permissions to do the specific thing you’re asking it to do, nothing broader.

Edge Case: Agent Context Leakage

One thing that doesn’t work: trusting the model to “not leak” credentials. It will, either in logs, error messages, or future prompts where context bleeds. It’s not malicious, it’s just how these systems work.

This happens in unexpected places. An agent running GPT-5.4 makes an API call that fails with a 403 error message containing the token in the response body. The agent logs the full response for debugging. Later, when you ask the agent a question about “what went wrong,” it includes that error message in its reasoning, and now the credential is in the conversation transcript.

Short-lived tokens solve this. Even if the credential leaks 48 hours later in a backup or audit log, it’s already expired. The damage window is closed.

Network isolation is your second line of defense. If the token somehow makes it into the agent’s context and the agent tries to exfiltrate it to an unauthorized endpoint, the egress allowlist blocks it. The agent can’t reach attacker infrastructure even if it wanted to.

Audit logging catches the attempt. You see the failed egress, you revoke tokens, you investigate. Fast signal, fast response.

The Cost of Defense

This adds operational overhead. You’re running agents in containers with monitoring, managing token rotation, maintaining vault infrastructure. But compare that to the cost of a real breach where an agent with overpermissioned credentials exported your codebase or customer data.

Token rotation itself is cheap at scale. AWS STS tokens are free. Vault tokens are lightweight. The real cost is engineering time to wire it all up correctly the first time.

Bottom line: Give agents short-lived, scoped credentials through a vault service, run them in network-isolated containers with egress controls, and log everything. No single mechanism saves you. You need all three working together, and you need to verify that the framework you’re using (Claude Code, Cursor Agent, Devin) actually enforces these boundaries, not just recommends them.

Question via Hacker News