luismori.
AI Agents AI Security Secrets Management

Keep Secrets Out of the Agent: Brokering, Rotation, and Infisical

Env vars and .env files put the real credential inside the agent's process. A proxy keeps the value out of the agent's requests, and on a server, rotation reaches running agents without a restart. What Infisical covers, what it doesn't, and how to test your own setup.

15 min read
Keep Secrets Out of the Agent: Brokering, Rotation, and Infisical

TL;DR

  • Env vars and .env files put the real credential in the agent’s process. Commands started from that environment inherit it [INFERENCE], so every command the agent starts can read it.
  • A proxy keeps the value out of the agent’s environment and requests. The agent holds a placeholder, and the proxy attaches the real credential to outgoing HTTP(S) calls. Whether an upstream can echo the credential back is undocumented.
  • Rotation depends on where the proxy runs. On a server, Infisical’s Agent Vault proxy checks for updated values every poll interval, 60 seconds by default, so a rotated value takes effect within one interval. On a laptop, the local Agent Proxy fetches values when the run starts. Restart after rotating until you run the test at the end of this article.
  • Agent Vault and the local Agent Proxy broker only HTTP(S). Infisical’s PAM agentic access covers databases and SSH, which we did not research here. We found no independent security audit of these proxies.
  • The laptop proxy installs a trust root for its certificates. On macOS, its key sits in your home directory, outside the agent’s sandbox (an OS-level restriction on the agent process). We infer that an unsandboxed process running as you could read it [INFERENCE].

The leak is in the agent’s process, not only in git

The GitGuardian counts below cover public GitHub commits only. In 2025 the report found 28.65 million new hardcoded secrets in public commits, up 34%. Commits co-authored with Claude Code leaked a credential in 3.2% of cases, against 1.5% overall. By December 2025 that rate had fallen to 13 secrets per 1,000 commits, effectively the human baseline, though those commits remain consistently larger. The same report found 24,008 unique secrets in MCP-related config files, and 2,117 of them were verified as working when detected.

Revocation lags detection. Of the credentials confirmed valid in 2022, over 64% still worked when retested in January 2026. The report calls this an operational signal that remediation, not detection, is still the industry’s limiting factor.

The second case happens on the machine itself. On August 26, 2025, malicious Nx packages ran a post-install script that scanned systems for sensitive data. The script also tried to use local AI tools such as Claude and Gemini, then uploaded what it found to public GitHub repositories. [INFERENCE] The AI tool on your laptop is a credential-bearing process that a malicious script running as you could reach.

The lessons are concrete. What sits in your environment is readable by what runs in it [INFERENCE]. And commits are only one place secrets leak.

Where the value sits while the agent runs

Ask two questions of each placement: can the agent read the value, and what does rotation need?

PlacementCan the agent read the value?What rotation needsInfisical product
Process environment (sm run, op run)YesInjected at start; a new run picks up the new valueinfisical sm run
Rendered fileYes, if the path is readableInfisical Agent polls every 5 minutes by default, then runs a reload hook: a command it runs when a secret changesInfisical Agent
Agent Vault proxy on a serverNo; placeholder onlyPolls every 60 seconds by default; no restartAgent Vault
Standalone Agent Proxy on a serverNo; placeholder onlyRe-fetches every 60 seconds; no restartAgent Proxy (start, connect)
Local Agent Proxy on a laptopNo; placeholder only; where the host supports it, the sandbox blocks direct routesFetched at run start; restart until testedAgent Proxy (run)

Agent Vault and Agent Proxy are different products. The CLI reference says Agent Vault “is a different product from the agent proxy that infisical sm agent-proxy runs.” Mixing their settings is an easy way to get rotation wrong.

flowchart LR
  subgraph server["Server: Agent Vault proxy"]
    S1["Agent: placeholder only"] --> S2["Proxy on a separate host<br/>attaches credential"]
    S2 --> S3["Upstream API"]
    SI["Infisical"] -- "poll every 60 s" --> S2
  end
  subgraph laptop["Laptop: local Agent Proxy"]
    L1["Agent in OS sandbox: placeholder only"] --> L2["Proxy on the same machine<br/>attaches credential"]
    L2 --> L3["Upstream API"]
    LI["Infisical"] -- "fetch at run start" --> L2
    L1 -. "direct route blocked where supported" .-> L3
  end

The pattern is not unique to Infisical. Anthropic’s hosted Claude Code keeps git credentials outside its sandbox and attaches them in a proxy (Anthropic’s engineering post, published 2025-10-20). Its cloud environments also offer network secrets: keys you add stay outside the sandbox and attach to matching requests (Claude Code docs, accessed 2026-10-30). Self-hosted environments don’t have network secrets.

Laptop: the local Agent Proxy

run starts a proxy, launches your agent inside an OS sandbox, and stops both when the agent exits:

infisical sm agent-proxy run --projectId=<project-id> --env=dev --path=/coding-agent -- claude

The sandbox covers the agent and every command the agent runs. It doesn’t cover commands you run in your own shell, such as npm install. Inside the run:

  • The agent gets placeholders for secret-substitution credentials, not the real values. Services that use header rewrites need nothing in the environment, because the proxy sets the header itself.
  • The run removes variables whose names look like credentials, including those with TOKEN, SECRET, PASSWORD, or API_KEY. You can pass one back with --pass-env if you accept the risk.
  • Credential paths such as ~/.aws, ~/.ssh, and ~/.infisical are denied. The local Agent Proxy docs list the full set, so check it against your own stores. Where the host supports it, the proxy is the only route out. On Linux without a private network namespace, the sandbox falls back to shared networking with a warning, and tools that ignore proxy variables then go direct. On Windows, run refuses to start without --no-sandbox.

The trust root. The proxy must terminate TLS to attach credentials, so it signs certificates with a self-signed local root. Where that root lives depends on your OS:

  • macOS: run stores the root under ~/.infisical/agent-proxy, a path the sandboxed agent can’t read, and adds the root to your login keychain once. You get one password prompt on the first run, and the trust persists. [INFERENCE] Anyone holding the root’s key can mint certificates that system-trust tools accept for any host, so gh and Go binaries could be intercepted. Decline the prompt unless you need those tools through the proxy. If you decline, tools that use the system trust store fail, while curl, Python, and Node still work through environment variables. The docs we read don’t describe removal; check Keychain Access for the root if you stop using the laptop proxy.
  • Linux: the root is generated in memory for each run, and the docs say environment variables are sufficient.

The docs say the CA private key is never written to the per-run temporary directory, but they also say that re-opening ~/.infisical would hand the agent the local CA private key. [INFERENCE] We infer that an unsandboxed process running as you could read that key, such as a malicious install script of the kind the Nx incident used. Commands you run in your own shell, such as npm install, are outside the sandbox. On a machine where you install untrusted packages, assume those packages can read the key.

To see the placeholder pattern work, this check adapts the local docs’ GitHub example to print only the status code. The command sends only the placeholder:

infisical sm agent-proxy run -e dev -- \
  sh -c 'curl -sS -o /dev/null -w "%{http_code}\n" https://api.github.com/user -H "Authorization: Bearer $GITHUB_TOKEN"'

This assumes a proxied service for api.github.com whose secret is named GITHUB_TOKEN. The docs say GitHub still answers as you. We haven’t run it here, so a 200 would confirm it.

Rotation on a laptop. The local run fetches proxied-service values when it starts, and dynamic leases refresh before they expire. The docs don’t say whether static values refresh mid-run. Until you run the test in the last section, restart after rotating.

Server or CI: the Agent Vault proxy

On a server, run the proxy on its own host, and keep that host on a private network that only your agents can reach. Keep the proxy token out of shell history and process listings: read it from a file only your user can read (chmod 600), and pass it as an environment variable, not a flag, because on most systems other users can see command-line arguments.

INFISICAL_AGENT_VAULT_PROXY_TOKEN="$(cat ~/.config/agent-vault/proxy-token)" \
  infisical agent-vault proxy --domain <your-instance-url>

Agents then run through the proxy. The session token is set only for that command, not for your whole shell:

INFISICAL_AGENT_VAULT_SESSION_TOKEN="$(cat ~/.config/agent-vault/session-token)" \
  infisical agent-vault run --proxy <proxy-host>:17323 -- claude

Before you rely on it, know these behaviors:

  • Refresh. The proxy checks Infisical for updated values every poll interval, 60 seconds by default, configurable from 10 to 300. A rotated value takes effect within one interval.
  • Failure. If the proxy can’t reach Infisical, it serves from its last data for five intervals, then returns 502. It doesn’t forward requests without credentials.
  • Protocols. It attaches credentials to HTTP/1.1 requests over HTTPS and plain HTTP. WebSocket connections and HTTP/2-only clients, such as gRPC, fail through it. If an API offers both WebSocket and HTTPS, configure the agent for HTTPS, since many SDKs fall back when WebSocket fails. Codex may log connection errors before it falls back to HTTPS.
  • Other hosts. Hosts outside the session’s access bundle pass through without a credential, unless traffic policy blocks them.
  • Network exposure. Agents send their session token to the proxy unencrypted with every request. If someone can read that traffic and reach the proxy, they can use the token to call every API in the session’s access bundle until the session expires or is revoked, so keep the traffic on a private network. The standalone Agent Vault security docs say the token’s Proxy-Authorization header travels in cleartext between the agent and the broker.
  • Placement. Keep the proxy off the agent’s machine. The Agent Vault Claude Code guide says that on the same machine, the agent could read the proxy token and the private key of the proxy’s certificate authority. Separately, [INFERENCE] an agent running as your user could read your Infisical login token, in ~/.infisical or the macOS keychain, unless a sandbox blocks that access.

The other server option is the standalone Agent Proxy (infisical sm agent-proxy start, with agents using connect). The agent authenticates with a machine identity. The standalone proxy re-fetches secret values every 60 seconds and applies a rotated value within one interval, without restarting the agent.

Rotation, by credential

Rotation coverage depends on the provider. As of 2026-10-30, the docs sitemap lists 30 rotation and 32 dynamic-secret provider pages. Dual-phase rotation, which most providers use, keeps the previous credential valid until the next rotation, so clients keep working. Single-phase rotation has no overlap period, so clients fail until they fetch the new value. The entries that matter for most agent setups:

CredentialInfisical modeDetails
Cloudflare API tokenRotation, two overlapping credentialsGenerated tokens expire at twice the rotation interval plus one day, with a minimum of seven days.
GitHub personal tokenNo rotation pageUse GitHub App tokens from a dynamic secret instead (our recommendation). They are fixed at one hour and can’t be revoked or renewed, so a leaked one stays usable for up to an hour.
Anthropic API keyNo rotation or dynamic pageRotate by hand.
OpenAI service account; OpenRouter, LiteLLM, Fireworks keysRotationListed in the docs sitemap.
Postgres, MySQL, MSSQL, MongoDB, OracleRotation with two usersInfisical alternates two users. The previous password stays valid as a grace-period credential until the next cycle.
RedisRotationA new credential each cycle.
Cloud IAM and some databasesDynamic secretsCredentials minted per identity with a short lifetime that Infisical can invalidate promptly after use. The sitemap lists AWS IAM, GCP IAM, and Azure Entra ID.

Plan limits change, so check the pricing page before you commit. As of 2026-10-30, on Secrets Management, full rotation and dynamic secrets start at the Advanced plan, and Pro rotates public databases only. Agent Vault bills per brokered request, meaning any request where the proxy attaches a credential. As of 2026-10-30, Agent Vault’s Pro plan makes the first 5,000 brokered requests a month free, then $2 per 1,000. Read against that definition, an LLM call that carries an attached credential would count [INFERENCE].

What brokering does not cover

  • Non-HTTP traffic. The Agent Vault proxy fails WebSocket and HTTP/2-only clients. The local and standalone Agent Proxy pages both say “Only HTTP and HTTPS are brokered.” Infisical’s PAM agentic access covers databases, servers, and Kubernetes accounts through local proxies; we didn’t research it.
  • Tools that ignore proxy variables. Inside the laptop sandbox, they fail loudly. On Linux, when the private network namespace isn’t available, they can go direct (see above).
  • Hosts outside the bundle. They pass through with no credential unless traffic policy blocks them.
  • The trust root. On macOS, its key sits outside the sandbox (see above). [INFERENCE] An unsandboxed process running as you could read it. A server proxy run on the agent’s machine could expose its certificate authority key the same way; the Claude Code guide says the agent could read it.
  • Reflection. We found no documentation of whether an upstream can echo a credential back in a response or an error body.
  • Independent review. The only third-party code read we found covers the standalone Agent Vault (an open-source project its docs say is no longer maintained, as of 2026-10-30) at version 0.39.3. It found that keys stay hidden from agents, but that its defaults are permissive: unmatched hosts pass through, and agents run with no sandbox by default. We found no review of the platform Agent Vault proxy, the standalone Agent Proxy, or the local Agent Proxy.

Check it yourself: does your laptop run pick up a rotated key?

The docs don’t settle whether a laptop run refreshes static values, so test it. The test needs a run that outlives a rotation and makes two requests:

  1. Create two fine-grained GitHub tokens with no repository permissions: token A and token B. Store token A in Infisical as the secret GITHUB_TOKEN, and map it to a proxied service for api.github.com. The local docs say the run sets a placeholder for each secret-substitution credential in the folder, so check that the variable name matches.
  2. Check token B with a direct request outside the run (expect 200). If it fails, a later 401 proves nothing.
  3. Start the run from your project directory, with explicit flags, and keep the pause long:
infisical sm agent-proxy run --projectId=<project-id> --env=dev --path=/<folder> -- sh -c '
  curl -sS -o /dev/null -w "before: %{http_code}\n" https://api.github.com/user -H "Authorization: Bearer $GITHUB_TOKEN"
  sleep 600
  curl -sS -o /dev/null -w "after: %{http_code}\n" https://api.github.com/user -H "Authorization: Bearer $GITHUB_TOKEN"
'

Stop unless before prints 200.

  1. In the first minute of the pause, update the Infisical secret to token B and revoke token A.
  2. Compare the codes. before: 200 then after: 200 means the proxy picked up the new value mid-run. before: 200 then after: 401 means it kept the old one, so restart after rotating.

Three rules for this test. Decline the macOS keychain prompt; curl trusts the root through environment variables, so the test still works. Print status codes only, never headers or bodies, and skip header-echo endpoints, which would print the credential. Use tokens with no permissions, and revoke both when you finish.

Routing checklist

  • HTTP API, laptop: the local Agent Proxy. Restart after rotating until the test above passes.
  • HTTP API, server or CI: the Agent Vault proxy. A rotated value applies within one poll interval, 60 seconds by default. The standalone Agent Proxy is the alternative if your team already uses machine identities.
  • File-only consumer: Infisical Agent, with a reload hook (a command it runs on change).
  • Environment-only value: sm run or op run. Restart the command after rotating.
  • Database or SSH: a different path, such as PAM or dynamic secrets. Not covered here.
  • Infisical’s MCP server: set INFISICAL_MASK_SECRET_VALUES=true. It returns secret values by default, and it enforces no permissions of its own, so scope the machine identity tightly.

Sources