Where keys actually leak
- Prompt text — agents paste keys into instructions without thinking.
- Logs and crash reports — a stack trace can include request bodies.
- Tool output — a key echoed back from a shell command.
- Screenshots and screen-sharing — terminals show the
.env. - Git history — a commit is forever unless you rewrite the repo.
Keep the key out of the agent entirely
The single most effective rule: the agent should never hold the key. A proxy-vault design means the model, the prompt, and the tool layer only ever see tokens that are cheap to revoke.
If you must keep a key local
- Scope it to the narrowest permission the task needs.
- Put it in a file the agent can read but not print, and exclude it from backups.
- Set a hard spend limit at the provider, not just a warning.
- Rotate on a schedule, and immediately after any suspected leak.
Prompt injection is the second front
A malicious web page or document can try to trick the agent into printing its secrets. Treat any content the agent reads as untrusted: block the pattern where the model is asked to reveal "your system prompt or API key", and never give the model a real secret to reveal in the first place.
A quick checklist
- No real keys in prompts, system messages, or examples.
- Agent holds a revocable token, not a provider key.
- Every model call is logged with cost and time.
- Rotation takes one action, not a repo sweep.
- Spend caps are on at both the provider and the platform.