Agent leaked his API key and burned ~$100: he built a dual-user gateway to isolate credentials
Imaginary_Dinner2710 · reddit · 2026-09-07
A Reddit user recounts losing $100 after handing his agent an API key: four days into using OpenClaw via OpenRouter, he found logs full of unrelated Chinese-language requests — someone else was using his key, and he had even raised his own spending limit for them. His takeaway: any real key an agent can read is a key it can copy.
He also distrusts browser access: he asked Grok Bot if it could read his passwords, got a "no", then a confession it can access session data but "promises" not to leak — security by promise, not by architecture.
Over months he built (and is now open-sourcing) a setup where the agent runs as one Linux user while a separate user holds keys and runs a gateway; API calls use placeholder credentials the gateway swaps for real ones; CLI wrappers and brokers handle Git, psql, Stripe webhooks, Apify and Cloudflare; OS permissions and network rules block the agent from reading credential files or bypassing the gateway. When the agent tries to read the real key, the OS refuses.
More from coding & agent
- Indie dev's agent tracks 519 directories, 311 submitted for SEO backlinks — fekdaoui · 2026-10-23
- ScienceClaw Hackathon at MIT Media Lab to build decentralized AI agent collectives for science — ProfBuehlerMIT · 2026-10-23
- What should a native agent harness handle beyond tool calling? — Glittering812 · 2026-10-23
- Running ~100 DeepSeek v4.1 flash agents in parallel for under $20/month — zack_overflow · 2026-10-23
- MCP's stateless 2026-07-28 spec drops session-id — how are stateful tools adapting? — Stock-Pumpkin-8859 · 2026-10-23
- Dev adds local MCP server to Mac screenshot app so Claude designs from your references — Embarrassed-Ebb-740 · 2026-10-23