After 1M+ cloud agents, Unreal Labs shares its rule: agents never see credentials
alifcoder · x · 2026-10-14
After a year of running 1M+ cloud agents, Unreal Labs shared the core of its agent security architecture: the agent never sees the credentials.
- The logic: agents are useful and risky for the same reason — they can act. A bad chatbot answer is annoying; an agent holding your API keys can leak them.
- The approach: every request leaving the sandbox passes through a proxy that injects credentials on the way out.
The team also published a longer thread on the broader component stack built for diverse use cases and security needs.
More from coding & agent
- Anthropic monorepo merged 30,401 changes in a single day as AI agents scale coding — TheZvi · 2026-10-14
- Everyone shipped their own harness, now everyone is shipping their own GitHub — tekbog · 2026-10-14
- Microsoft's TeleTune turns offline telemetry into agent skills, cutting tokens up to 75x — EliasEskin · 2026-10-14
- "AI is still dumb at architecture": devs swap war stories of bad model advice — teropa · 2026-10-14
- "Coding isn't solved—you just stopped reading the code" — prasenx · 2026-10-14
- Superhuman coding agents are here, yet we still build the same web apps as 5 years ago — mhmazur · 2026-10-14