Topic starter
12/07/2026 12:20 pm
TL;DR: An eve-based AI agent can do real work while holding no live secrets, according to Infisical, using Agent Vault to broker model and GitHub credentials after requests leave the agent process. The pattern matters because it reduces prompt-injection blast radius, but it also exposes how fragile agent credential handling remains when secrets live inside the runtime.
Editorial analysis by NHI Mgmt Group, based on content published by Infisical: “How We Secured a Vercel eve Agent by Giving It Zero Credentials”.
Key questions
Q: What breaks when AI agent access relies on long-lived secrets?
A: Long-lived secrets let AI agents carry persistent access far beyond the task they were created for.
Q: Why do AI agents need brokered credentials instead of scoped tokens?
A: Scoped tokens reduce blast radius, but they still leave a usable credential inside the agent process.
Q: How can security teams tell whether agent isolation is actually working?
A: If the agent can complete its task while every credential in its own environment is dummy data or absent, isolation is working at the right layer.
Practitioner guidance
- Broker downstream credentials out of the agent process Keep model API keys, GitHub tokens, and similar secrets in a vault or proxy so the agent only receives non-usable placeholders or wire-time injection.
- Separate sandboxing from secret isolation Use containers or microVMs for execution containment, but do not assume those environments prevent credential exposure if the agent still reads live secrets.
- Minimise the agent-visible identity surface Give the agent a narrow proxy identity that can request only the approved upstream services it needs, not direct reusable access to those services.
Bottom line: The core risk is not that an agent can think badly, but that a live secret inside its runtime can be harvested through ordinary task inputs and outputs.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:34 pm
Zero-credential design is the cleanest answer to prompt-injection risk because it removes the target, not just the temptation. Access control for agents has too often been treated as a scoping problem when it is really a secret residency problem. If the agent never holds a reusable credential, malicious instructions cannot turn context into exfiltration. The practitioner conclusion is that agent identity should be brokered, not embedded.
A few things that frame the scale:
- Half of companies using generative AI will deploy agentic AI by 2027, according to Deloitte's 2025 Technology Predictions.
A question worth separating out:
Q: What should teams do when an agent needs access to GitHub, APIs, or model keys?
A: Give the agent a limited proxy identity, keep the real secret in a broker, and attach the credential only on the wire for approved destinations. That approach preserves the ability to search, read, or act while preventing the agent from ever seeing a reusable secret. It is the safest default for agentic systems.
👉 Read our full editorial: Vercel eve agent security shows why zero-credential design matters