Secrets & Trust
Keeping credentials safe while autonomous agents act on your behalf — trust models, least privilege, and secret-leak attacks.
8 articles
Shared Memory Poisoning: One Bad Write, Many Agents
Shared memory poisoning can expose many agents to one bad write. Use a three-trust matrix and consumer-side hygiene to limit the risk.
How Do AI Agents Trust Each Other? A2A, OAuth and mTLS
A2A and MCP hand identity to OAuth, OIDC and mTLS. A signed Agent Card proves origin, not trust; RFC 8693 scopes delegation; prompt injection stays open.
Least Privilege for AI Agents
Least privilege bounds what a tricked AI agent can do — not whether it's tricked: authz policy, JIT tokens, and the confused-deputy ceiling it can't cross.
Prompt Injection Is a Credential-Exfiltration Attack
Prompt injection is a 3-stage credential kill chain: injection lands, the agent reads a secret, it leaves via an allowed channel. Three defenses matter.
The Trust-Model Spectrum for AI Agent Secrets
Six rungs of protecting an AI agent's secret, weakest to strongest—each defeats a different threat, but none stops a tricked agent misusing what it unlocks.
Credential the LLM Never Sees for MCP Tools
Credential the LLM never sees: resolve secrets below the model, inject them on the wire, and account for MCP, logs, and confused deputies.
Memory Poisoning: The Patient Path to Your API Keys
A poisoned AI agent memory can wait weeks, then leak an API key. Persistence and key-theft are each demonstrated; chaining them isn't—yet. Here's the fix.
AI Agent Secrets: Why the Nagging Won't Save You
AI agents warn about API keys because the risk is real. But warning after a secret enters context is not protection.