Agent Proxy: Secure Credential Brokering for Agents | InfisicalIntroducing Infisical Agent Proxy:Secure AI agents without giving them access to real credentials.

27kTalk to an expertGet started for free

27k starsTalk to an expertGet started for free

← Back<br>Blog post • 8 min read<br>Agent Proxy: Secure Secrets Brokering for Agents

Published onThursday, July 30, 2026

In April, we launched Agent Vault, an open-source HTTP credential proxy and vault, which was one of the first purpose-built, standalone MITM transparent proxy implementations for brokering credentials to agents. Today, we’re announcing its commercial grade successor: Infisical Agent Proxy.

At Infisical, we process billions of secrets per month including application configuration, database credentials, API keys, and more for all kinds of workloads. This includes AI agents, which consume secrets, but in a different format. In the past year, we’ve observed credential brokering become ubiquitous for combatting credential exfiltration against agents. Credential brokering lets agents use credentials to access services without reading any underlying values. This works by passing requests through a dedicated proxy which attaches credentials onto requests at the network boundary before forwarding them outbound to a destination.

The concept of an agent proxy has become so common that I’d argue it represents a new kind of infrastructure primitive, alongside sandboxes, designed specifically to address the security guarantees needed for secure agent deployments; I believe it is one of many components that will constitute the AI cloud in the nascent future.

Today, we dive into secrets brokering and how Agent Proxy delivers the commercial grade proxy needed for any secure agent infrastructure deployment. Hopefully, this article makes for an interesting read and is useful for anyone who needs to securely provision agents access to services; you might even consider taking Infisical Agent Proxy for a spin.

How We Got Here

If you’re not familiar with the domain space of credential exfiltration and agent proxies, our original Agent Vault launch post provides a fuller read. We dive into why traditional secrets management designed for deterministic callers breaks down for non-deterministic actors (i.e. agents).

In short, my claim was that most of today’s computing paradigms weren’t designed for agents but for traditional workloads with fixed execution paths. After all, for most of computing history, autonomous software agents were more science fiction than engineering reality. Now that they’re real, we're discovering that many of the assumptions our software infrastructure was built on no longer hold.

Agents, being non-deterministic actors, present a new kind of challenge, where the underlying process is probabilistic, which makes it vulnerable to leaking secrets through attack vectors like prompt injection. This is the machine equivalent of social engineering, manipulating an agent into disclosing information or taking actions it otherwise wouldn’t. But the challenge doesn't stop there. Prompt injection can originate from almost anywhere, from explicit user input to data the agent ingests as part of its normal workflow. Even without any attackers, most organizations don’t want agents sending credentials to LLM providers. This gets pretty gnarly fast.

Agents, at least in their current state, cannot be trusted with holding secrets directly. There has to be a dedicated forward HTTP proxy beside each agent (be it through a dedicated service, sidecar, or egress layer) to securely broker credentials for it to access the external world.

Many sophisticated agent deployments have now converged on this pattern. It’s the same principle described across Anthropic’s Managed Agents architecture blog, Vercel’s credential brokering, Cloudflare’s outbound workers, and most recently in Claude Tag’s architecture. While each variation of secrets brokering has its own architectural nuances, the general principle is that the agent has no access to real credential values; if anything, it might have fake credentials the broker swaps for real ones at the edge.

This is precisely what led us to build and open-source Agent Vault, one of the first dedicated secrets brokering implementations for agents.

What We Learned

It turns out that when you launch something that addresses a real "hair on fire" problem like credential exfiltration with the right ergonomics, it gets adopted pretty fast. Despite minimal promotion, Agent Vault crossed 2,000 stars on GitHub in just a few months with usage spanning tens of thousands of installations, millions of agent runs, and dozens of agents including Claude Code, OpenClaw, and even non-agentic untrusted code.

Looking back, Agent Vault’s success came down to a handful of product engineering decisions that, together, made this particular implementation of secrets brokering practical:

Architecture: Agent Vault took a non-invasive transparent MITM...