Models are great conversationalists. They are terrible vaults.
If a secret ends up in the prompt, the logs, the trace, the fine-tune corpus discussion, or the screenshot you pasted into Slack, the secret is no longer a secret. It is a story waiting to travel.
A solid rule is simple: models never hold secrets. They can request work that needs secrets. The environment injects credentials at the last safe moment, outside the model context window.
What counts as a secret
Not only API keys.
- tokens and passwords
- private URLs with embedded credentials
- customer identifiers you promised to protect
- internal VPN configs
- signing keys
- session cookies
- that “temporary” access key from last Thursday
If it can create access, move money, or expose someone else’s data, it stays out of the chat.
Env injection over paste culture
The anti-pattern is familiar: “here is the key, now call the API.”
The better pattern:
- Agent writes code or a request shape without credentials
- Runtime pulls secrets from env, a vault, or a secrets manager
- Network call happens in a controlled process
- Logs redact sensitive headers and bodies
- The model sees success/failure, not the credential
The model can know that STRIPE_API_KEY exists. It should not know the value.
Vault lookups outside the window
For agent systems, you like tools that say: “fetch secret reference X” and return a handle the runtime understands, not a plaintext blob back into the LLM.
If your tool returns the raw secret into the conversation transcript, you only moved the leak downstream. Congratulations on the architecture diagram. The transcript still has the crown jewels.
Design tools so the model never needs the value to proceed.
Prompt leakage is sneaky
People focus on model providers. Fair. Also look at:
- local history
- IDE agent transcripts
- evaluation datasets copied from prod
- bug reports with real headers
- support exports
- screenshots in tickets
A disciplined vault does not help if someone pastes .env into a chat because debugging felt urgent.
Urgent is when habits matter most.
Practical rules you enforce
- No secrets in repo, ever, even private repos
- No secrets in prompts, system or user
- Redaction middleware on logs
- Short-lived credentials where possible
- Separate accounts for agents with least privilege
- Rotate when exposure is even suspected
- Teach teammates the “models are not vaults” line until they roll their eyes
Eye rolls mean the message landed.
Checklist
- Secrets live in a manager or env, not in markdown notes
- Agent tools cannot echo secret values back
- CI uses OIDC or scoped tokens, not long-lived pasted keys
- Example files use placeholders only
- Incident plan includes transcript review
A near miss mindset
I assume a near miss will happen someday: a log line, a careless paste, a vendor debug session.
That assumption keeps blast radius small. Least privilege is not paranoia. It is manners for systems that talk too much.
Closing
Never let models hold secrets. Let them orchestrate work. Let the runtime hold keys. Let the vault do vault things.
Eloquent software still leaks. Design like the conversation will be forwarded. Because someday, somehow, a piece of it will.
Teach by default deny
When someone asks an agent for a key, the right answer is a tool that performs the action without disclosure, or a human path for break-glass access.
Default deny sounds harsh until you imagine the transcript forwarded to the wrong channel. Then it sounds polite.
Rotate on suspicion. Investigate without shame. Blameless process beats silent dread. Secrets hygiene is a team sport, and teams need drills, not only slogans.
If you only remember one line, remember this: the model can know the name of the env var. It should never need the value to be useful.
Closing
Keep secrets out of the context window like you keep passwords off sticky notes. Same instinct. New surface area. Same stakes.
Agent identity
Bottom line
Give agents their own low-privilege identities. Do not share your personal cloud keys with a chatbot like it is a roommate you trust because it speaks politely. Polite roommates still should not get the master keys.
