Skip to main content
Infisical Agent Vault is an access layer for AI agents. Agents route their API calls through a proxy that attaches the real credentials on the way out, so the agent itself never holds them. If a prompt injection tricks the agent into revealing a credential, there’s nothing there to reveal.

Agent Vault docs

Access bundles, services, sessions, proxies, and access control.

​
Why brokering access matters for agents

Traditional secrets management involves returning credentials back to applications and services. This isn’t suitable for AI agents because a credential in the agent’s environment can leak in many ways. An agent may inadvertently include it in a log line, a message, or a tool call it makes, or an attacker may deliberately extract it through prompt injection. Infisical Agent Vault solves this by brokering credentials using a proxy at the network boundary. The proxy attaches real credentials to services you’ve allowed, and only until the session expires (or you revoke it).