{"slug": "why-your-ai-coding-agent-should-never-see-your-api-keys", "title": "Why your AI coding agent should never see your API keys", "summary": "A developer has released Trustless, an open-source CLI that prevents AI coding agents from exposing API keys and other secrets. The tool injects credentials into subprocesses while sanitizing output, proxies HTTP requests with per-host credentials, and scans outbound LLM calls for secret patterns. It addresses the risk that agents, which read source and config and transmit summaries to third-party APIs, can leak secrets through prompt injection or verbose logs.", "body_md": "Your AI coding agent needs your API keys. It needs them to call services, to\n\ntest integrations, to run your stack. So you give it `.env`\n\nfiles, or you\n\nexport keys into the environment, or you paste them into config files the\n\nagent can read.\n\nThat means your secrets live inside the agent's context window — the same\n\nwindow where a prompt-injected instruction or an overly verbose debug log can\n\nleak them to an attacker or an untrusted model endpoint.\n\nThis isn't theoretical. If you've used Claude Code or OpenCode for more than a\n\nfew days, you've probably seen a tool call dump an environment variable, or a\n\nlog line that echoes a connection string. Most of the time nothing bad\n\nhappens. \"Most of the time\" is a bad security posture.\n\nAI agents are the first software that *reads your source, your config, and\nyour secrets*, then sends summaries of what it read to a third-party API.\n\nWith traditional software, the principle was simple: secrets live in the\n\nprocess environment, code reads them at runtime, nobody reads them back out.\n\nWith agents, there is no such boundary — the agent both *reads* the\n\nenvironment and *transmits* what it knows.\n\nThree concrete leak vectors:\n\n`.env`\n\nand includes values in a\nlater prompt to an external model. You can't audit this; it's in the model's\ntraining/inference pipeline.The solutions fall into a few buckets:\n\n`.env`\n\nhidingI ended up building a small CLI (Go, zero external deps) with three layers:\n\n**Subprocess injection with output sanitization.** `trustless run -- cmd`\n\nresolves secrets from my existing pass store and injects them as env vars.\n\nAfter the command runs, stdout/stderr is scanned and secret values are\n\nreplaced — including base64 and URL-encoded variants. The agent sees the\n\ncommand output, not the keys.\n\n**HTTP proxy with per-host injection.** For services that take headers or\n\nquery params (EDINET, e-Stat, xAI, OpenRouter), `trustless proxy`\n\ninjects\n\nthe right credential per host. The agent points at `127.0.0.1:8080`\n\nand\n\nforgets about keys entirely.\n\n**DLP reverse proxy for LLM calls.** `trustless serve`\n\nputs a scanning\n\nproxy in front of OpenAI-compatible endpoints. Outbound requests are\n\nchecked against secret patterns (keyword → regex → entropy, gitleaks-compatible\n\nrules) and masked in-flight before they leave the machine. This is the\n\nlayer that catches the \"agent decided to include the key in a request\" case.\n\nWhy not a new vault? Because I already had pass. The CLI reads the existing\n\nstore, so there was zero migration. (Bitwarden is supported too, with OAuth\n\ntoken auto-refresh for Google/Lark.)\n\nThe agent gets capabilities, not credentials. That's the whole trick.\n\nIf you want to look at the code: trustless is MIT-licensed at\n\n[https://github.com/ikkun1222/trustless](https://github.com/ikkun1222/trustless) — 321 tests, race-detector clean,\n\ncosign-signed releases. It's one implementation of this model; the threat\n\nmodel discussion is more valuable than the tool itself.", "url": "https://wpnews.pro/news/why-your-ai-coding-agent-should-never-see-your-api-keys", "canonical_source": "https://dev.to/ikkun1222/why-your-ai-coding-agent-should-never-see-your-api-keys-1hem", "published_at": "2026-08-15 02:02:59+00:00", "updated_at": "2026-08-15 02:11:39.666589+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "developer-tools", "ai-infrastructure"], "entities": ["Trustless", "Claude Code", "OpenCode", "OpenRouter", "xAI", "Bitwarden", "pass", "gitleaks"], "alternates": {"html": "https://wpnews.pro/news/why-your-ai-coding-agent-should-never-see-your-api-keys", "markdown": "https://wpnews.pro/news/why-your-ai-coding-agent-should-never-see-your-api-keys.md", "text": "https://wpnews.pro/news/why-your-ai-coding-agent-should-never-see-your-api-keys.txt", "jsonld": "https://wpnews.pro/news/why-your-ai-coding-agent-should-never-see-your-api-keys.jsonld"}}