Ask HN: Do you trust AI agents with API keys / private keys?

Re:Ask HN: Do you trust AI agents with API keys / private keys? by jvqv on Sunday April 12, 2026 @04:10AM (#47737207)

As a precaution I would probably never pass secrets directly to the agent at all. Something like a placeholder format where the actual substitution happens at execution time so the LLM never sees the real value. Keeps things cleaner if something ever goes wrong.

[ Parent | on HN ]

Re:Ask HN: Do you trust AI agents with API keys / private keys? by devendra116 on Sunday April 12, 2026 @04:25AM (#47737298)

is there any tool that can do this ?

[ Parent | on HN ]

Re:Ask HN: Do you trust AI agents with API keys / private keys? by para_parolu on Sunday April 12, 2026 @04:36AM (#47737364)

I use mitmproxy outside of agent vm

[ Parent | on HN ]

Re:Ask HN: Do you trust AI agents with API keys / private keys? by devendra116 on Sunday April 12, 2026 @11:09AM (#47740628)

interesting, how do you use mitmproxy for calling openAI llm ? or what exactly you use it for ?

[ Parent | on HN ]

Re:Ask HN: Do you trust AI agents with API keys / private keys? by para_parolu on Friday April 17, 2026 @11:59AM (#47807356)

Mitmproxy it to avoid giving model access to secrets.

My assistant lives in ubuntu vm. When I ask it to “check email” it uses imap with password “xyz” and fetches emails.

But my mail password is actually “abc”. Mitmproxy outside of vm replaces all “xyz” to “abc” for outgoing requests. And reverse for incoming

[ Parent | on HN ]