Secrets vault: your AI uses your keys without seeing them

A quick exercise before we start. Open your email, type “password” into the search bar, and see what comes up. Go on, I’ll wait.

Well? An admin login sent two years ago “until we find something better”, an API key pasted into a team chat, an “Access” spreadsheet shared with half the company? Don’t worry, you are far from alone. According to GitGuardian’s 2026 report on secrets sprawl, 28% of secret leaks happen solely outside code repositories, in collaboration and productivity tools. Secrets, in the jargon, are all those passwords, API keys and access tokens that open your tools to a person or a machine.

Until now, the problem was mostly human. With AI agents, it changes scale: people hand them keys so that they can work on their own, and an agent reads everything, copies everything, and sometimes obeys anyone. This article from our Business AI section tells the story of the leaks we have come across in recent months, what AI changes about them, and the solution we offer: a vault that you hold the keys to, whose contents your AI tools use without ever seeing them. And one that even we do not open. Spoiler: the answer is not to hide the key under the doormat.

Where are your passwords and API keys lying around?

Wherever it was convenient at the time. That is the whole mechanism of a leak: nobody decides to publish a key. It lands wherever it helps out, and then it is forgotten.

Here is what we found in recent months. Nothing exotic, and that is exactly what is worrying.

The trifecta, on a single project. In July, the audit of a project we support turned up a CRM admin key, with every permission (read, edit, delete), written in plain text in a script saved in the code repository. The script had a name that promised to wipe everything, and the key expired in about a hundred years. Forward-thinking. The same audit found a local configuration file, supposed to stay on a developer’s machine, tracked in the repository history. And this autumn, while redoing the technical inventory of the same project, we came across a tool’s administrator password, written out in full in an installation guide stored with the code.

The remedy is always the same:

Remember the rule: a key that has been visible is a dead key.

The green publishing pipeline that published nothing. At another client, the automatic publishing pipeline was missing its secrets. The result: everything showed green, nothing went live, and nobody noticed. A misplaced secret does not always make a sound when it falls.

And what about us? The day we decided to run all our agents in the cloud rather than on a single computer, some keys were still living in a file on the founder’s machine. If that one machine fails, nobody knows where the keys are or which ones to change. The agents, for their part, could no longer read them, and that was just as well: a key the agent has never seen is a key it cannot leak. Everything that follows starts from there.

ANSSI, France’s national cybersecurity agency, had in fact said it all in one line as far back as October 2021, in its recommendations on authentication and passwords:

It is hard to be clearer.

Why do AI agents change the scale of the problem?

A human with a password in front of them does not recite it to a stranger (usually). An AI agent does. Not out of malice: it reads everything it is given, it carries out instructions, and it does not always tell the difference between yours and the ones a smart aleck has slipped into an email or a ticket. If you are still unsure how an agent works, our article on the AI agent loop takes it apart piece by piece.

Three true stories, to set the scene.

When the attack makes the victim’s AI do the work. On 26 August 2025, booby-trapped versions of Nx, a very widely used development tool, were published. According to Wiz’s analysis, the malicious code instructed the coding assistants installed on the machine, using the options that switch off their safeguards, to search the disk for cryptocurrency wallets, SSH keys and configuration files. The toll, in two waves:

The AI was not the flaw. It served as a sniffer dog.

When the agent copies the keys into a ticket. In July 2025, researchers at General Analysis showed, and Simon Willison wrote it up, how a coding agent connected to a database with administrator permissions could be tricked by a simple support ticket. The ticket contained hidden instructions. By reading it, the agent could copy the contents of an integration tokens table into a reply visible to the attacker. It is a demonstration, not an incident, but the scenario is so ordinary that it sends a chill down the spine. Simon Willison gave it a name:

When a stolen AI key can cost $46,000 a day. In May 2024, Sysdig’s research team described “LLMjacking”: attackers steal cloud credentials to use hosted AI models, and resell access to them, at the victim’s expense. In the worst case Sysdig calculated, the bill exceeds $46,000 of usage per day. An AI key left lying around is a bank card taped to the shop window. And top-tier AI is not getting any cheaper: ChatGPT’s most expensive plan has gone from $20 to $500 a month in three and a half years.

The figures point the same way. Again according to GitGuardian, commits co-authored by a widely used coding assistant leak secrets about twice as often as average (yes, we use one too: all the more reason never to give it a key). OWASP, the foundation that is the reference for application security, draws the conclusion in its 2025 ranking of the risks of AI applications: no API key in a model’s instructions, and critical controls, such as privilege separation, “must not be delegated to the LLM”. In other words: do not ask the AI to keep a secret. Make sure it has none.

How can an AI use a key without seeing it?

This is the key point (sorry), and it is simpler than it looks.

Think of the concierge of a block of flats. You tell them, “Send the delivery man up to the fourth floor.” The concierge opens the door with their pass, the delivery man drops off his parcel and leaves, and he never once holds the pass. And if he very politely insists on visiting the fifth floor, the concierge refuses.

With an AI agent, the concierge is called a relay, and it happens in four steps:

1. The agent asks for an action: “send this quote by email”.
2. The relay, placed between the agent and the service, checks that this agent is allowed to do it.
3. The relay takes the key from the vault and adds it to the request at the moment it leaves, only towards the address of the intended service.
4. The service replies. The agent receives the result, never the key, and the log records who did what, with which key, and when.

The AI model only sees the action and the result go by. The key only travels from the vault to the service.

The result: even if it is fooled by an instruction hidden in a document, the agent has nothing to repeat. Nor can it send the key elsewhere, since the relay only adds it for the intended service. The lethal trifecta loses a leg. And this is not science fiction: it is already how our own agents work when they publish code. The key is added along the way by the network layer, and it never enters their working environment.

What we offer, in practice

We are not selling one more piece of software. We set up a proven vault for you, connect your tools and your AI to it, then hand the keys back to you. With these commitments:

• The vault is in your name. On your server or with a host in Europe, but always in your name. You are its administrator, and if you change provider, the vault and all its contents stay yours.
• Even we have no access. This is the part that surprises people most. At handover, our access is removed, and every key we may have come across during the project is changed: what we saw is worth nothing. Need us later? You open time-limited access, and the log keeps a record of it.
• Your AI tools use the keys without seeing them. The concierge principle, applied to your agents and your automations.
• Everyone sees only what concerns them. One identity per person, per automation and per agent, with only its own permissions. A contractor leaves? You cut their access without touching anyone else’s.
• A key changed once is up to date everywhere. The vault feeds your tools, your hosting and your publishing pipelines. No more hunting for copies in ten files.
• A log that answers within minutes. Who used which key, when, and from which tool. The day a doubt arises, you have an answer instead of an investigation.
• No home-made encryption. The core of the vault is proven open-source software, whose code is public. Our job is the installation, the connections and the handover of the keys. We do not reinvent the lock.
• A fallback plan. If you lose access, a procedure written and tested with you entrusts recovery to two people you appoint. We keep no spare copy: that would be exactly the access we promise not to have.

The project runs in four stages: an inventory of your secrets and of the leaks already there, opening the vault in your name, connecting your tools and your agents one by one, then handing over the keys. The scope, timescales and prices are on our AI vault page. And for each agent to also have its own budget and caps, there is our “AI at the right cost” pack.

Where to start, even without us?

No need to wait for a project to stop the bleeding. Four steps, in order:

1. 01Take stock.

   Email, spreadsheets, code repositories, automation tools, workstations: note down where your passwords and keys live, and who has access to them.

2. 02Change any key that has ever been visible anywhere.

   Not “we’ll see”: now. GitGuardian checked that 64% of the valid secrets spotted in 2022 still worked four years later. Attackers have not forgotten them.

3. 03Never give a key to an AI model.

   Not in its instructions, not in its documents. Give each agent its own identity, with the narrowest permissions possible: our guide to AI governance in business explains how to divide up those permissions.

4. 04Turn on two-factor authentication wherever it exists.

   A stolen password is no longer enough to get in.

The vault is part of what every new project should find waiting when it starts, along with the accounts, the access and the backups: our guide to the foundation of a cloud infrastructure goes through it all. And to know where your AI models should run depending on how sensitive your data is, our comparison of the four levels of private AI sets out the options, from a commercial API to a server on your own premises. The other decisions, from the task to hand over to human oversight, are in our guide to integrating AI in your business, in the order they are taken.

To sum up: the best secret is the one nobody needs to know, not even your AI. If you want us to look at where yours stand, contact us.

Frequently asked questions

Sources

1. GitGuardian’s 2026 report on secrets sprawl (new tab)gitguardian.com
2. Recommendations on authentication and passwords (new tab)messervices.cyber.gouv.fr
3. Wiz’s analysis (new tab)wiz.io
4. Simon Willison wrote it up (new tab)simonwillison.net
5. “LLMjacking” (new tab)sysdig.com
6. Its 2025 ranking of the risks of AI applications (new tab)genai.owasp.org