Re: secrets, just some thoughts… FWIW I think nobody has fully solved this yet 😅 Well 🤔 re: the problem, I’m afraid it’s more than a (finite) number of tools; the LLM can whip up some Python to read just for fun. But yes… so if it becomes part of an Observation, kill it… There shouldn’t then be a need to do the same on a future Action, aka LLM response, because, well… the LLM wouldn’t know it. Simon has a topic somewhere on the sdk where we looked into secrets, and drafted a solution to use a broker that allows to have only short-lived tokens in the env. That, however, is not exactly against the agent, it’s against mistakes/misses in the _application_(s). However, once in place, it seems to allow us to do other things like: • have a file system watcher • (or event listener, but also for logging actions or system level writes) • when the watcher sees we logged a secret or it became part of an event or otherwise on disk, invalidate it 🤔 Or maybe I’m missing something? So it would be invalidated after the fact, but, hey, it’s invalid

🤔 i have some work on this problem as well but nothing public. i don't think there is a one-size-fits-all solution. we can scan the file-system but what do we do about software that store in .env? i use

pass

to manage my keys (passwordstore.org) and that means making helpers that load the key as variable at execution, in the CLI

🤔 I use the OS’s keystore… basic, but slightly better than .env IMHO 😅 This is the brainstorming issue mentioned above Design: reference-only credentials

I sorta feel like we're trying to compensate for convenience. Frequent key rotation, keys that have a very short life. I used to work with medical data. I developed the thinking that some keys are effectively single use. Situations where you mint, use, and expire creds as constituents of one process. Really, maybe the problem is that we need to define the threat model? If the consumer ranges from a vibecoder (who may have no related training) to corporate enterprise environments, it's tough to think about what is being secured and what it means to be secured.

Yes, I think the proposal is trying to make them all short-lived somehow. Well, the user sets up LLM API keys, and any bunch of others, and I don’t think they would set e.g. 24h to manually re-paste every day. Notion key, Nvidia, whatever they work with. This is my agent’s newest installation, and it already set up two.😅