What Is an Agent Vault? How AI Agents Use Your Passwords Without Seeing Them

Short answer: an agent vault stores the credentials an AI agent is allowed to use, and lets the agent use them without the model ever reading them. The password, token or key is supplied at the last possible moment, by filling a form, adding a header to a request or handing over a short-lived token, by a component the model doesn't control. The agent gets the access. It never gets the secret.

If you searched for "vault agent" and landed here, you may be looking for HashiCorp Vault Agent, the client daemon that authenticates to HashiCorp Vault and renders secrets for applications. That is a different thing, built for servers and Kubernetes. This article is about vaults for AI agents. (Infisical, confusingly but reasonably, sells an open-source product literally called Agent Vault. More on it below.)

Why AI agents need a different kind of vault

For a decade, secrets management has worked like this: a central vault delivers secrets to a program, and the program uses them. That works because a normal program does exactly what its code says. It won't decide to email your API key to a stranger.

An AI agent might. Not because it's malicious, but because it follows instructions, and instructions can come from anywhere it reads. Infisical describes the attack plainly: someone prompt-injects an agent and tells it to sweep the secrets in its environment and send them back. If the secret is sitting in an environment variable or a config file, a sufficiently persuaded agent can read it and leak it.

This isn't hypothetical. On October 8, 2026, Zenity Labs disclosed "AgentCorruption," a chain of issues in AWS's AgentCore platform where, by Zenity's account, a single prompt could compromise every agent in an AWS account. Coverage of the issue centered on a prompt that simply asked for credentials.

The rule that falls out is simple: if the model can read a secret, assume the secret can leak. So the job of an agent vault is to make the agent use credentials without reading them.

The four ways agents get credentials today

1. Pasting secrets in

It's the default because it's easy, and it's the one to stop doing. A password typed into a chat ends up in the model's context window, probably in logs, and possibly in the agent's long-term memory. Coding agents have the same problem with .env files. If the agent can open the file, the key is in play.

2. OAuth connections

When a service supports OAuth, you never give the agent a password. You approve access once, the provider issues a token limited to certain permissions, and a broker stores it. Identity providers now sell this pattern specifically for agents. Auth0 has a token vault for AI agents, and AWS AgentCore has an identity service that holds tokens on an agent's behalf. You can revoke the connection at any time without changing your password.

3. Credential proxies

For API keys there's often no OAuth. The newer answer is a proxy. Infisical launched Agent Vault in April 2026 as an open-source HTTP credential proxy and vault: the agent's traffic goes through it, and it attaches the real credentials on the way out, so the agent never holds them. In July it followed with Agent Proxy. 1Password introduced a Credential Broker in June aimed at humans, machines and agents.

4. Brokered autofill

Most of your personal life sits behind website logins, not APIs. Here the vault acts like a careful assistant at the door. When the agent hits a sign-in page, it asks for a credential, you approve, and the vault types it straight into the page.

1Password shipped the clearest example in July 2026 with Anthropic's Claude. When Claude needs to sign in, 1Password shows which credential is being requested and why, waits for biometric approval, then fills it directly into the page. Afterwards it checks whether the secret was exposed on the page, and if the login fails it clears the fields before handing control back. A related "Agentic Mode" locks the rest of the vault while an agent is driving, so only logins approved for the current task are reachable. Proton Pass added monitored credential sharing for agents in May, and OpenAI's ChatGPT Work separates the login step from the model's activity and checks login pages for phishing.

What makes a good agent vault

Whatever product you use, these properties matter.

1. The model never sees plaintext. Secrets are injected at the boundary, into a form or a request, by code the model doesn't control.
2. End-to-end encryption, with delegation you choose. By default the service storing your vault should only hold ciphertext. If the company can read your passwords, so can anyone who compromises the company. Letting a cloud agent use your logins while you're away means trusting the service with a key, so it should be an explicit choice you can see and revoke, never the default.
3. Approval or narrow policy for every use. Either you approve each use, or a rule says exactly which agent may use which credential for which task.
4. Bound to the right site. A login for your bank should only ever be filled on your bank's exact web address. This one property defeats most phishing, including pages built to trick agents.
5. Scoped and short-lived where possible. Tokens that expire in minutes and can only do one thing are better than keys that last forever and can do everything.
6. An audit trail. You can see which agent used which credential, when, and for what.
7. Easy revocation. Cutting off an agent shouldn't require changing every password you own.
8. Recovery without a backdoor. You can get your vault back if you lose a device, without the provider holding a master key.

An example: booking a restaurant with a saved login

Say you text your agent: "Book us at Bistro Lune on Saturday, the usual time."

1. The agent opens the restaurant's booking site in an isolated browser and finds a slot.
2. The site asks you to sign in. The agent pauses and requests your saved login for that exact site.
3. You get a prompt on your phone or Mac: "Agent wants to use your Bistro Lune login to book a table, Sat 7:30." You approve.
4. The vault fills the credentials into the page. The model sees that you're now signed in, nothing more.
5. Before the final "Book" click, the agent shows you the details and waits for your OK.

Two approvals, both quick, and at no point did your password enter a conversation, a log or a model. Some vaults, ours included, also let you approve agent access once instead of per use. The fill works the same way: the password goes into the page, never into the model.

How Agentastic's vault works

Agentastic's account vault is end-to-end encrypted. Your vault is encrypted on your devices before it reaches us, and we store only the encrypted data and the minimum metadata needed to operate it.

• Device-only by default. Each trusted device holds its own keys, and you keep an offline recovery code. There is no server-side master key and no admin recovery backdoor. Unless you turn on agent access, we hold no key that can decrypt your vault.
• Agent access is opt-in. To let your agent sign in for you from the cloud, say while you're texting it on iMessage, you choose Allow agent access in your unlocked vault. That adds an agent device, which one of your trusted devices approves like any new device.
• Logins get filled, not handed over. The agent sees your saved logins as labels, sites and masked usernames. When it needs one, the login is decrypted and filled straight into its cloud browser, and only into a page on the exact site that login belongs to. The model never receives the password, screenshots mask it, and every use is logged.
• You can switch it off instantly. Turning agent access off destroys the agent's keys and rotates your vault's keys, so the agent device can't decrypt anything new.
• The trade-off, plainly. While agent access is on, our service holds a key that can decrypt your vault in order to do this. If you'd rather keep the device-only guarantee, leave it off. Your agent then sends you a link to use the login yourself on a device you trust.
• Connected apps use connections, not passwords. Gmail, Notion and other apps connect through sign-in flows you can revoke at any time.

The bottom line

An agent that can't use your accounts isn't much of an agent. An agent that holds your passwords is a liability. An agent vault is how you get the first without the second: access through a component the model can't talk into misbehaving, with you approving anything that matters.

Sources

• Infisical, Agent Vault: The Open Source Credential Proxy and Vault for Agents (April 22, 2026) and Agent Proxy (July 2026)
• The Next Web, 1Password lets Claude log you into websites without ever seeing your passwords (July 16, 2026)
• Yahoo Finance, 1Password Introduces Credential Broker (June 15, 2026)
• Help Net Security, Proton Pass adds monitored credential sharing for AI agents (May 22, 2026)
• MacStories, Anthropic Introduces an In-App Browser for Claude Cowork (Aug. 27, 2026), on ChatGPT Work's login handling
• The Next Web, Zenity says one prompt took over every AgentCore agent in an AWS account (Oct. 8, 2026)
• HashiCorp, Vault Agent documentation