{"slug": "sealed-secret-execution-for-ai-agents", "title": "Sealed secret execution for AI agents", "summary": "Ironrun, a new open-source tool, seals AI agents' access to secrets like API keys and database URLs by running them in an encrypted workspace with time-boxed leases and redacting secrets from output. The tool stores secrets in an AES-256-GCM vault locally or federates to 1Password, Vault, Doppler, or Infisical, and assumes the agent is compromised, blocking exfiltration through multiple layers. Ironrun is available as a single binary for macOS and Linux under the MIT license.", "body_md": "Every AI agent runs inside your shell, wired straight to your real API keys, database URLs, and tokens. It doesn't forget what it reads, either. ironrun seals them in one encrypted workspace, hands the agent a time-boxed lease instead of the value, and redacts anything that slips into output. The agent finishes the job. It never sees the secret.\n\nKeys, database URLs, tokens: if it's in your environment, the agent can read it. And it doesn't forget. Claude Code logs every tool call to ~/.claude/projects, argument by argument. A secret that passed through one command is sitting in that file, in plaintext, right now.\n\nDrop a YAML file in your project. ironrun handles the vault, the subprocess, and the output. Your agent calls one tool. It gets back exit code, timing, and redacted output. Never the secret values that ran inside.\n\nSecrets live in ironrun's local encrypted vault: AES-256-GCM, on your machine. Or federate to 1Password, Vault, Doppler, or Infisical. Pulled at exec time. Never written to disk.\n\n```\nversion: \"2\"\nenvironment_set: active\ncommands:\n  - id: deploy\n    secrets: [STRIPE_SECRET, AWS_SECRET]\n```\n\nRuns with a clean environment and no shell. Nothing to inject through. Only the command you named runs.\n\n```\ncommands:\n  - id: deploy\n    argv: [./deploy.sh, --prod]\n    ttl: 30s\n    no_network: true\n```\n\nEvery byte of output runs through a rolling pattern match before the agent sees it. A secret shows up in stdout? Gone before it leaves the process.\n\n```\n# What the agent receives:\nexit_code: 0\nduration_ms: 191\nstdout: \"Deployed. key=[REDACTED]\"\n# secret values: [REDACTED]\n```\n\nironrun assumes your agent is compromised. Every layer blocks exfiltration on its own. Fail one, the others hold.\n\nThe agent asks for access, you approve a time-boxed lease, and only then does a sealed process ever touch a secret. Secrets exist only inside that process. Never serialized. Never logged. Never in the agent's context. This isn't a wrapper around your commands. It's a wall between your secrets and the model.\n\nironrun stores secrets in a local AES-256-GCM vault, or federates to the 1Password, Vault, Doppler, or Infisical you already run. What it adds: agents get time-boxed access, secrets inject below them, and values are redacted from everything they see. Here is what that covers and what it does not.\n\n`~/.claude/projects`\n\nand shipped upstream. ironrun redacts the value too. Defense in depth, not a replacement.ironrun is **defense in depth, not a guarantee**. A seatbelt, not an armored car. It composes with the controls you already trust (scoped tokens, read-only database users, a sandboxed agent) and adds the layer they miss: the secret value never enters the agent's environment or context, so it can't be logged, cached, or exfiltrated through it.\n\nironrun sits between your agent and the shell. If it runs shell commands, it works with ironrun.\nNative MCP support gives your agent twelve tools with zero config: run sealed, request access, propose commands. Just `ironrun init`\n\nand done.\n\nInstall it, run `ironrun init`\n\n,\nand your agent is wired up. The policy, MCP config, and CLAUDE.md get written for you.\n\nA single binary. macOS and Linux, arm64 and amd64. Nothing else to run.\n\n``` bash\n# verifies the checksum before running\n$ curl -fsSL https://ironrun.dev/install.sh | bash\n```\n\nironrun init detects your project, creates an encrypted dev environment, and writes the policy, MCP config, and agent instructions. Add your commands and secrets to the workspace.\n\n``` bash\n$ cd your-project\n$ ironrun init\n  - Created ironrun.yml\n  - Created encrypted environment dev\n  - Created .mcp.json\n  - Created CLAUDE.md\n```\n\nYour agent asks for access once; you approve in the TUI. Then it calls run_sealed instead of the shell. Secrets go in, redacted output comes back.\n\n```\n# Agent calls the MCP tool:\nrun_sealed(\"test\")\nexit_code: 0\nstdout: \"ok - key=[REDACTED]\"\n```\n\nOne YAML file. Secrets sealed below the agent. MIT licensed, forever.", "url": "https://wpnews.pro/news/sealed-secret-execution-for-ai-agents", "canonical_source": "https://ironrun.dev/", "published_at": "2026-07-20 23:33:32+00:00", "updated_at": "2026-07-20 23:53:09.848892+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "developer-tools"], "entities": ["ironrun", "Claude Code", "1Password", "Vault", "Doppler", "Infisical"], "alternates": {"html": "https://wpnews.pro/news/sealed-secret-execution-for-ai-agents", "markdown": "https://wpnews.pro/news/sealed-secret-execution-for-ai-agents.md", "text": "https://wpnews.pro/news/sealed-secret-execution-for-ai-agents.txt", "jsonld": "https://wpnews.pro/news/sealed-secret-execution-for-ai-agents.jsonld"}}