What is a credential isolation proxy?

A component that stores a secret and attaches it to an outbound tool call on the agent's behalf. The agent names the credential by handle, so the value never appears in the prompt, the conversation, or the traces you keep of them.

Why not just put the API key in an environment variable?

An environment variable already keeps the key out of the conversation, and that is most of the benefit. The proxy adds two things: the value is requested through a masked prompt rather than pre-provisioned, and it lives in one component you can rotate and audit instead of in every process that runs a tool.

Does a credential proxy stop prompt injection?

No. It stops an injected instruction from reading the key, but not from using it. The agent can still be talked into calling the tool it was already allowed to call, which is a question of how narrowly that call was authorized rather than of where the secret is kept.

How does this relate to the lethal trifecta?

The trifecta needs private data, untrusted content, and an outbound channel together. Moving credentials into a proxy cuts the private-data leg for that class of secret, and it is usually the cheapest leg to cut because it removes the value without removing the agent's ability to do the work.

Agent· 2026-09-07

OpenClaw 2.0 keeps secrets out of the model's context — Credential isolation proxy — What does it mean?

TL;DR

What is it: The news anchor is OpenClaw 2.0, an open-source agent runtime released on September 1, 2026, and the concept it makes concrete is the credential isolation proxy — a component that holds a secret and attaches it to an outbound tool call, so the value is never part of what the model reads.
Why it’s needed: Every secret an agent can read is a secret an attacker can make it repeat, so an agent that keeps API keys in its conversation carries that key into every later turn, every stored transcript and every trace span you log.
vs previous: The previous approach was to paste the key into the prompt, or into an environment the model can inspect, which makes the entire conversation as sensitive as the key itself; the proxy moves the value to the far side of the boundary, so a leaked transcript leaks nothing.

Jargon

Credential proxy: A component that stores a secret and attaches it to an outbound request on the caller's behalf. The caller names the credential by handle; it never holds the value.
Model-visible context: Everything the model actually reads on a given turn: the system prompt, the conversation so far, the tool schemas and the tool results. If a value is in there, the model can repeat it. Why context is a scarce resource →
Lethal trifecta: The three ingredients that together make an agent dangerous: access to private data, exposure to untrusted content, and a way to send data out. An attack needs all three. Walk the trifecta →
Prompt injection: Instructions smuggled into content the agent reads — a web page, an email, a tool result — which the model then follows as if you had written them.
Exfiltration: Getting data out of the system through a channel that looks ordinary: a URL the agent fetches, a message it sends, a file it writes. See the tool-call channel →
Tick: One turn of the agent loop: the model reads its context, decides, a tool runs, and the result goes back in. A session is a stack of ticks. Look inside one tick →
Trace span: One recorded step of a run, kept by your observability stack — what the agent did on one tick, usually with the prompt and the result attached.
Blast radius: How much an attacker reaches once one thing is compromised. A key in the transcript has the blast radius of the transcript; a key in a proxy has the blast radius of the proxy.

The news. On September 1, 2026, the OpenClaw project released OpenClaw 2.0, a rebuild of its agent runtime around durable sessions, paired local and cloud workers, and explicitly scoped permissions. Two parts of the release are about where a secret lives: credentials are requested through a masked prompt rather than typed into chat, and they can be proxied to tools without the value entering model-visible context. Interactive outputs and recurring automations get narrow grants instead of inheriting broad permission. Read the release notes →

Keep the card reader in mind. The bartender takes your order, rings it up, and turns the terminal toward you. You tap. The terminal talks to the bank, the bank answers, and the bartender hears one word: approved. The person doing the work never learns your card number, and that is the design — not a rule about what they are allowed to say, but a path the number never travels.

An agent harness can be built the same way. The model decides a tool has to run and emits the call — send_invoice, query_db, deploy — naming the credential it needs by handle rather than by value. The harness stops there and asks you for the secret through a masked prompt, so the characters go into the harness and not into the conversation. When the call goes out, the harness attaches the real value at the boundary. The tool result comes back, and the model reads the result. The key was used in the room; it was never written on the page the model reads.

That distinction matters because the model re-reads its whole conversation on every turn. A secret typed into chat is not stored once. It is replayed into the prompt of every later tick, copied into every trace span that records the prompt, and kept in a conversation you can search months later. A value in the model's context is not a stored value, it is a broadcast one.

Tool needs a keyagent emits the call

Masked promptyou type it, chat does not keep it

Proxy injectsat the tool boundary

Agent reads resultnever the secret

The AI Agents track draws agent risk as three legs that have to meet: access to private data, exposure to untrusted content, and a way to send data out. An attack needs all three, and the tools themselves are the surface where they connect. The credential proxy is a cut to the first leg, and it is the cheapest of the three to cut, because it changes plumbing rather than capability — the agent still calls the tool, it simply cannot read the key that authorizes the call.

Compare that with the other two. Cutting the second leg means keeping untrusted content away from the agent, which usually means giving up the feature: an agent that cannot read email cannot triage email. Cutting the third means blocking outbound channels, and a tool call is itself an outbound channel, so the list of things to block is long and open-ended. The first leg is the one where the value can be moved without the capability moving with it.

It does not make the agent safe. A proxied key can still be used by an injected instruction — the agent told to send one invoice can be talked into sending forty. That is what the sibling mechanism in this same release, operation-scoped approvals, is for. The proxy stops the secret from leaking; it does not stop the authority from being misused.

Where you put the key	Where the value lives	What can read it	If the transcript leaks
Pasted into chat	the conversation	the model, on every later turn, plus your trace store	the key leaks
Environment variable on the tool process	the process the tool runs in	the tool, and anything that can read that process	the key does not leak — unless a tool echoes it back into a result
Masked prompt plus credential proxy	the proxy	the proxy, and the outbound request it signs	the key does not leak

Put numbers on it (illustrative). Take one session of 40 ticks, with the key pasted into chat on the first one. The model re-reads the conversation each turn, so that key is replayed into 39 outbound prompts — ticks 2 through 40. If your tracing records the prompt on each span, and recording the prompt is the usual default, that is 39 more copies sitting in your observability store. Add the stored conversation itself and one secret now exists in 79 places, none of them a vault, most of them in systems whose retention you chose without a secret in mind.

Now run the same session through a proxy. The key is written once, into the proxy. The model's context holds it zero times — at tick 1 and at tick 40 alike. The 40 tool calls still carry it, because they have to; they carry it on the outbound leg, where it was always going to travel. What changed is not how often the secret is used, it is how many systems keep a copy: 79 down to 1.

Goes deeper in: AI Agents → Security & the Lethal Trifecta → Cut a Leg

Related explainers

OpenClaw 2.0 scopes automation approvals to one operation — the other half of the same release: the proxy hides the secret, the scoped approval bounds what the agent may do with it.

Frequently Asked Questions

Check what you knowMap your AI & GPU knowledge across every track — free, role-based