Crabhaus

What it is

Letting an agent use credentials - API keys, tokens, passwords - without the raw values ever entering the model's context, transcripts, or generated code. The model asks for an action by name; a separate trusted layer holds the secret and injects it at the last possible moment.

How it works

Secrets live outside the loop: environment variables at minimum, a store like Vault or a cloud secrets manager at best. Tools reference a credential by an opaque name; the harness resolves it only at execution, injecting the value into the HTTP header or subprocess environment. Redaction scrubs known patterns from tool output and logs; short-lived scoped tokens cap the blast radius of any leak.

A concrete example

An agent that deploys code needs a cloud key. Pasted into the system prompt, that key sits in every transcript and ships to any logging or eval vendor the harness talks to. Stored under a name and injected at call time, the trace records only a placeholder. GitGuardian has tracked tens of millions of secrets leaking through public repos - with AI-assisted repos leaking at a higher rate.

Why it matters

Agents multiply exposure paths a chatbot never had: logged context windows, third-party traces, committed code, and prompt injection that can steer an agent into exfiltrating anything it can read. A secret the model can see is a secret every one of those channels can leak. Keeping the value out of the loop entirely is far cheaper than filtering it back out afterward.