The Agent Should Not See The Secret 🔐
$ZEC made the case that some things should be unreadable by default. $BNKR is now working with a team applying that idea to the thing an agent is most dangerous holding.
1Claw builds zero trust security for AI agents. Secrets live in encrypted hardware and execution happens server side, so the agent completes the action without ever seeing the credential.
That inversion is the whole idea and it is worth sitting with.
Most agent security work assumes the agent holds the key and tries to constrain what it does with it. Policies, limits, confirmations. All useful, all defending a position where the sensitive material is already inside the part of the system you understand least.
Holding the secret somewhere the model cannot read it removes that class of problem rather than managing it. A prompt injection cannot exfiltrate what the agent never had.
Their stack names three pieces. Shroud scans for malicious code, an Intents API signs transactions and runs calls server side, and automations and runtimes handle autonomous execution.
The limit is obvious and they do not hide it. Server side execution means trusting a different operator, and moving a risk is not the same as deleting it.
Still, the direction is right. If agents are going to touch money, the interesting question is what they are structurally incapable of leaking.
#AI #Security
$ZEC made the case that some things should be unreadable by default. $BNKR is now working with a team applying that idea to the thing an agent is most dangerous holding.
1Claw builds zero trust security for AI agents. Secrets live in encrypted hardware and execution happens server side, so the agent completes the action without ever seeing the credential.
That inversion is the whole idea and it is worth sitting with.
Most agent security work assumes the agent holds the key and tries to constrain what it does with it. Policies, limits, confirmations. All useful, all defending a position where the sensitive material is already inside the part of the system you understand least.
Holding the secret somewhere the model cannot read it removes that class of problem rather than managing it. A prompt injection cannot exfiltrate what the agent never had.
Their stack names three pieces. Shroud scans for malicious code, an Intents API signs transactions and runs calls server side, and automations and runtimes handle autonomous execution.
The limit is obvious and they do not hide it. Server side execution means trusting a different operator, and moving a risk is not the same as deleting it.
Still, the direction is right. If agents are going to touch money, the interesting question is what they are structurally incapable of leaking.
#AI #Security