Infisical launches Agent Proxy to keep API keys away from AI agents

Infisical launched Agent Proxy on July 30th, a credential proxy that lets AI agents call external services without receiving the underlying API keys, preventing credential theft via prompt injection. The San Francisco security startup co-founded by Vlad Matsiiako, Quang Tuan "Tony" Dang, and Maidul Islam designed the proxy to route agent traffic through a separate network component that injects real credentials only for configured services.

Infisical https://infisical.com , co-founded by Vlad Matsiiako @matsiiako https://x.com/matsiiako , Quang Tuan "Tony" Dang @dangtony98 https://x.com/dangtony98 , and Maidul Islam @maidulll https://x.com/maidulll , launched a credential proxy on July 30th that lets AI agents call external services without receiving the underlying API keys. https://x.com/infisical/status/2082864780402950210?s=46 https://x.com/infisical/status/2082864780402950210?s=46 The San Francisco security startup announced Infisical Agent Proxy in a thread on X https://x.com/infisical/status/2082864780402950210?s=46 and detailed the architecture in a launch post https://infisical.com/blog/agent-proxy written by Dang. Agents send requests using dummy credentials. The proxy retrieves the real secret from Infisical, inserts it into the outbound request, and forwards the request to the intended service. Matsiiako, Infisical's CEO, previously worked at Figma and bunq and studied at Cornell, according to Y Combinator's company directory https://www.ycombinator.com/companies/infisical . YC lists Dang and Islam as active co-founders alongside Matsiiako. The trio started Infisical in 2022 and joined YC's Winter 2023 batch, building an open-source alternative for managing the API keys, database credentials, certificates, and other secrets used across software infrastructure. Moving credentials outside the agent Agent Proxy is designed for a specific weakness in agent deployments: a model can be manipulated through prompt injection or hostile content found in documents, websites, messages, and tool output. If the agent process can read a real API key, an attacker may be able to induce it to reveal that key or send it elsewhere. Infisical's architecture moves credential handling into a separate network component. An agent routes HTTPS traffic through the proxy, which applies the real credential only when a request matches a configured service. Infisical's documentation https://infisical.com/docs/documentation/platform/agent-proxy/overview says compatible agents and untrusted workloads can use the standard HTTPS PROXY setting, allowing the Infisical CLI to redirect their HTTP clients without application-level code changes. Operators define which hostnames the proxy can serve and how authentication should be attached. Infisical ships more than 30 presets covering services including Anthropic, OpenAI, GitHub, Slack, and Datadog. Customers can also register custom host patterns and credential rules. The proxy can run through the Infisical CLI or as a Docker container. Infisical recommends placing it on a separate host near the agent infrastructure, preserving a boundary between the untrusted agent process and the component that can retrieve secrets. It can also run locally for agents tied to a developer's terminal session. The design addresses credential theft by preventing the agent from reading the secret value. Operators still need to limit what each agent can do with its authorized access. An agent that cannot reveal a GitHub token, for example, may still use the proxy to perform GitHub actions allowed by that token unless host, identity, and access policies restrict it. Turning an open-source test into a platform feature Agent Proxy follows Agent Vault https://github.com/Infisical/agent-vault , an open-source credential broker Infisical released on April 22nd. Agent Vault combined a secret store with the network proxy responsible for injecting credentials. Infisical says the project passed 2,000 GitHub stars and was used across tens of thousands of installations and millions of agent runs within several months. That adoption gave Infisical a path to pull the proxy into its larger commercial platform. Agent Proxy is stateless and retrieves secrets from Infisical rather than maintaining a separate vault. The product therefore inherits Infisical's role-based access controls, audit logs, secret rotation, access policies, approval workflows, and integrations. This integration is the strategic center of the launch. Credential brokering is becoming a common piece of agent infrastructure, and Infisical is using it to widen the role of its existing secrets platform. A customer already storing production credentials in Infisical can add agent access without operating another source of truth for secrets. Infisical says Agent Proxy is available with every Secrets Management plan, including its free tier https://infisical.com/pricing . That pricing lowers the barrier for developers to test the architecture while giving Infisical another route into production deployments, where companies may pay for additional identities, governance controls, dynamic secrets, and audit capabilities. Infisical's broader security push Infisical's main open-source repository https://github.com/Infisical/infisical has accumulated more than 27,000 GitHub stars. YC currently lists Infisical with a 50-person team in San Francisco. The startup announced a $2.8 million seed round https://infisical.com/blog/infisical-seed-round in July 2023 led by Gradient Ventures, with participation from Y Combinator and TwentyTwo VC. On June 7th, 2025, Infisical announced a $16 million Series A https://infisical.com/blog/series-a led by Elad Gil, with Y Combinator, Gradient Ventures, and Dynamic Fund participating. Its disclosed seed and Series A rounds total $18.8 million. Infisical said when announcing the Series A that it was cash-flow positive and was expanding beyond secrets management into certificates, key management, identity, and privileged access. Agent Proxy carries that expansion into AI infrastructure, where autonomous software increasingly needs access to the same production systems that security teams have spent years placing behind tightly controlled credentials.