Notifications
Clear all
Topic starter
11/08/2026 3:11 pm
TL;DR: AI coding agents can only do useful work when credentials are reachable, but that same reach creates a direct exfiltration path through prompt injection, poisoned repositories, and supply-chain abuse, according to Riptides. The security problem is not token strength alone, it is the assumption that an agent can safely hold secrets in its own execution environment.
NHIMG editorial — based on content published by Riptides: Your Coding Agent Should Never Hold a Token, Riptides Approach to Credential Brokering
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
Questions worth separating out
Q: How should security teams prevent AI coding agents from leaking credentials?
A: Keep credentials out of the agent’s process boundary, then broker access at the control layer so the agent never sees the reusable secret.
Q: Why do AI coding agents create a different token risk than normal automation?
A: Because the agent is making runtime decisions from untrusted text, not just following a fixed script.
Q: What breaks when credentials are embedded in agent configurations?
A: Embedded credentials break point-of-use governance.
Practitioner guidance
- Separate token possession from agent execution Keep live credentials outside the agent process, shell environment, and workspace so the runtime never has direct read access to reusable secrets.
- Scope every agent credential to one destination Bind each credential to a single service, repository, or API so a compromised agent cannot reuse the same token across GitHub, cloud consoles, and internal tools.
- Treat MCP tools as identity-bearing surfaces Review every connected tool, including MCP servers, for how it requests, stores, and reuses credentials before allowing the agent to call it.
What's in the full article
Riptides' full post covers the operational detail this post intentionally leaves for the source:
- The exact daemon attach and identity binding workflow used to broker credentials on the host.
- The step-by-step GitHub token demonstration showing how a dummy token preserves functionality without exposing the real secret.
- The implementation details behind destination-scoped credential injection for workstations, CI runners, and Kubernetes nodes.
- The discussion of auditability, AI session attribution, and why the model treats one agent task as one control unit.
👉 Read Riptides' analysis of AI coding agent credential brokering and token exposure →
AI coding agents and token exposure: are your controls keeping up?
Explore further
11/08/2026 3:25 pm
Credential brokering is becoming the correct control pattern for AI coding agents, not a niche hardening measure. Once an agent can inspect files, invoke tools, and respond to untrusted text, token possession becomes the wrong security primitive. The control question is no longer whether the agent can authenticate, but where the secret exists relative to the runtime that can be steered. For practitioners, that shifts attention from token strength to token placement.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
A question worth separating out:
Q: Who is accountable when an AI agent leaks a developer token?
A: The organisation remains accountable, because the agent was given access to a credential that should have been governed as a non-human identity asset. PAM, IAM, and lifecycle controls still apply, but they must be adapted to delegated tool use, short-lived access, and clear ownership for the broker or control plane.
👉 Read our full editorial: Credential brokering for AI coding agents: why tokens should stay hidden
