Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

Can a Coding Agent Use a Credential It Cannot Read?

Yes: Docker and Claude Code pair a sentinel with a proxy so the agent names a credential by reference, though the pages reviewed do not describe either as limiting what the model reads on a page. Check which side of the agent's machine the real value sits on.

A credential reference travels from a browser record through a bounded route to a separate API destination.

Developers often assume that an agent must read a credential to use it. That assumption is where most exposure starts, because it puts the value in front of a model that logs, caches and echoes what it sees. Several vendors now document a different arrangement, in which the agent works with a stand-in and a component outside its reach supplies the real value. An agent does not need to read a credential in order to use it. It needs a name for the credential and an environment that supplies the real value where the agent is not. For example, the agent in this page's record sees the placeholder GITHUB_TOKEN_01 in its view, and the real token is supplied only where the token is used, at a boundary the agent cannot read. This means the questions a team should ask are how far from the agent the substitution sits, what the agent can still know and do without reading the value, and who approves each use. What Is Least Exposure? supplies the framing for the distinction between using and reading. The vendor pages cited here were read on October 20, 2026, and each section says which statements come from them.

Key findings

  • An agent can use a credential it cannot read. Claude Code's documentation describes masking, where sandboxed commands see a sentinel and a local proxy substitutes the real value for hosts listed in injectHosts, while Read, Edit, Write, WebFetch, WebSearch, MCP servers and hooks run outside the sandbox (Anthropic, 2026).
  • Docker's Sandboxes credentials documentation describes a host proxy and a sentinel swap, which keeps the real credential outside the sandbox and does not address what a model reads on a rendered page (Docker, 2026).
  • Not reading a credential is not the same as being unable to misuse it: web-delivered attacks made multi-agent systems built on GPT-4o execute malicious code in "58-90% of trials," so hostile instructions should be assumed able to run (Triedman et al., 2025).
  • Adaptive attackers bypassed 12 published prompt injection defenses with success rates above 90% for most, so the control has to hold when the model is fooled (Nasr et al., 2025).
  • A governed environment that replaces values with consistent tokens before any model reads the screen means a settings page shows GITHUB_TOKEN_01 and never the string (What Is Least Exposure?).
  • Real values resolve only at the approved destination, and a named person approves each consequential action, so use of the credential is authorized by a person and not by the model's account of it (What Is a Tethered Agent?).

What does it mean to use a credential without reading it?

Reading and using are separate. To read a credential is to hold its value, in memory, in a file, in a context window or on a screen the model sees. To use it is to cause a request to be authorized by it. In the usual setup the two happen together: the agent reads the token and attaches it to the request. The alternative separates them. The agent refers to the credential by name, and something outside the agent attaches the value.

The record type is a placeholder, GITHUB_TOKEN_01, in the agent's view. The agent writes a request that carries the placeholder, or asks an adapter for an operation, and the real value is substituted where the agent is not. The agent can mention the placeholder in its notes, its commit message and its transcript, and none of them contains the credential. If the transcript leaks, the placeholder leaks, which is worth nothing.

Scope note: the controls discussed concern what an agent holds and what a proxy or adapter does for it. A governed browser environment, discussed at the end, covers what an agent reads and does on a rendered page. It does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP. Can an AI Agent Work With a Placeholder Instead of a Real Credential? takes the placeholder idea on its own, and How Do You Let an AI Agent Manage API Keys Without Reading Them? covers key handling.

What do the vendors themselves say?

Anthropic's Claude Code documentation describes credentials that can be denied or masked. With masking, sandboxed commands are shown a sentinel, and a local proxy substitutes the real value for hosts in injectHosts. Read, Edit, Write, WebFetch, WebSearch, MCP servers and hooks sit outside the sandbox, and the real value transits the proxy on the developer's machine (Anthropic, 2026). What the model reads on a page, and an approver for the call, are not described in the pages reviewed.

Docker's Sandboxes credentials documentation describes a proxy on the host and a swap of a sentinel for the real credential, so the credential stays outside the sandbox (Docker, 2026). What the model reads on a rendered page is outside that page's scope.

NVIDIA's NeMo Guardrails documentation defines input, retrieval, dialog, execution and output rails, and says "input and output rails are the most common" (NVIDIA, n.d.). Execution rails cover tool calls. The page reviewed describes rail types and does not describe replacing values with placeholders before a model reads a screen.

Source What it documents What the pages reviewed do not describe
Claude Code sandboxing Sentinel, injectHosts, local proxy What the model reads on a page; an approver
Docker Sandboxes Host proxy and sentinel swap What the model reads on a rendered page
NVIDIA NeMo Guardrails Input, retrieval, dialog, execution and output rails Value replacement before the model reads a screen

How far from the agent can the substitution sit?

The substitution can sit at four distances. Closest in, the agent's view contains a placeholder and nothing else and the environment supplies the value wherever the placeholder is used. One step out, a proxy at the sandbox boundary swaps the sentinel for the real value on the way out, as Claude Code and Docker describe. Further out, an adapter outside the sandbox holds the credential and the agent asks for operations, not hosts. At the fourth distance, the substitution happens where a screen is rendered, before any model reads it.

Distance Where the real value is supplied Who can still read it Example
Placeholder in view The environment The environment GITHUB_TOKEN_01 in the agent's notes
Proxy at the boundary A local or host proxy The proxy's host Claude Code masking; Docker host proxy
Adapter outside the sandbox The adapter The adapter's host A broker that makes the call
Render layer The destination, at an approved action The destination A settings page shown as tokens

Each step outward reduces the number of places the value exists. Arcade's product page lists "8,000+ agent-optimized tools across 80+ toolkits" reached through APIs, which describes tool access through an API and not what an agent reads on a rendered page (RedactSure vs Arcade: 2026 Comparison & Alternative, summarizing Arcade, 2026).

What does the agent still know and do without reading the value?

It knows the name. It can ask for the credential to be used, and the environment will use it for any host or operation the substitution allows. A credential the agent cannot read is still a credential the agent can spend. The host list, the operation list and the approval decide how much it can spend.

It can also be told to misuse it. Researchers found that web-delivered attacks made multi-agent systems built on GPT-4o execute malicious code in "58-90% of trials," with some configurations at 100% (Triedman et al., 2025). The result is about code execution in multi-agent frameworks, not about credentials, and it shows that the model's compliance with embedded instructions cannot be relied on. EchoLeak, a zero-click injection in Microsoft 365 Copilot (CVE-2025-32711), worked because the client "automatically fetches the external image URL included by the attacker" (Reddy and Gujral, 2025). Data left through a request the client made on its own.

The practical reading is that not reading a credential removes the credential from the places a transcript, a log or an injected instruction can reach, and does not remove the authority. What Can an AI Agent See in Your GitHub Settings? covers the pages where a credential's value is displayed, which is the case a proxy does not reach.

What does the leak record add?

GitGuardian's data, as reported by Help Net Security, counted "28,649,024 new secrets exposed in public GitHub commits across 2025," found that Claude Code co-authored commits "leaked secrets at roughly double the baseline rate," and counted "24,008 unique secrets exposed in MCP configuration files" (Help Net Security, 2025). The counts describe public repositories and do not isolate any tool's configuration. They explain why a credential the agent cannot read matters: the places where agents leak credentials are files, commits and configuration.

Columbia's DAPLab states that "trustworthy agent automation cannot be solved at a single layer of the stack" (Columbia DAPLab, 2026). Masking a credential is one layer. AWS's Well-Architected guidance for agents names another, attribution: "audit logs attribute every action unambiguously to either an agent or a human actor" (AWS, 2026). A credential the agent cannot read still needs a record of who authorized each use. Does AWS Bedrock Keep Company Credentials Away From Agents? covers one vendor's version. The leak record and the attribution guidance point at the same gap from two sides: what was exposed, and who used it.

What does a governed environment change?

A governed environment is a control class that acts where a screen is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so the model works on placeholders such as GITHUB_TOKEN_01. Real values resolve only at an approved destination, at the moment of an approved action. A named person confirms the tokenization policy and approves each consequential action. Every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.

For this question it is the fourth distance. A proxy substitutes on the way out and does not touch what the model reads on a page. If the agent works GitHub's token or settings pages in a browser, the string shown there is replaced with a placeholder before the model reads it, so the agent can use the credential by reference and cannot read it anywhere it appears. OWASP names the failure class as sensitive information disclosure, where a model's context or outputs reveal data that should not be revealed (OWASP, 2025).

Its scope is the rendered page. It does not govern the terminal, the IDE, the local filesystem, direct API calls or MCP, so an agent that uses a credential from a shell is a case for the proxy or the adapter.

Methodology and limitations

This page rests on Anthropic's Claude Code sandboxing documentation, Docker's Sandboxes credentials documentation, NVIDIA's NeMo Guardrails documentation, AWS Well-Architected guidance, OWASP guidance, three research papers, a press report of GitGuardian data, a Columbia lab page and existing RedactSure research pages. Sources were read between October 16, 2026 and October 20, 2026. Quoted facts are cited to the page that states them, and the press figures are cited as reported, not as independently measured. The page is a reading of public documents and should be read with each vendor's current documentation open.

The Arcade statement is taken from existing RedactSure research. RedactSure did not test any of the implementations hands-on. "Not described in the pages reviewed" means the pages reviewed and nothing broader. The four-distance table is a framework for comparison and not a description of any one product. Vendor features change, and the page carries its date. Statements about RedactSure describe its current design as set out in its Developer Workspace one-pager, and RedactSure is deploying now with enterprise and government customers. Examples describe record types, such as a placeholder in the agent's view, and not organizations. Each vendor page is cited for the statements it makes and for nothing it does not make. A statement that changes in a later release should be treated as unreviewed until the test is repeated.

Determinations about whether a credential arrangement meets a legal, contractual or regulatory requirement belong to counsel, assessors and the organization's own security and compliance officers. Nothing here replaces a review of the organization's own credential inventory, proxy configuration and approval policy.

What the record shows

The answer is yes, with a condition. Docker and Claude Code document the mechanism: sandboxed commands see a sentinel and a proxy supplies the value for approved hosts. The condition is that the agent can still spend the credential, so the host list, the operation list and the approval decide the exposure. The research record shows why the credential should not be in the agent's reach, since compliance with embedded instructions cannot be relied on, and the leak record shows where agents leak credentials. None of the pages reviewed describes what the model reads on a rendered page or who approves each use. Name one agent and one credential, then test where the real value is supplied, what the agent sees in its place, and who approves the first consequential use.

Frequently asked questions

Can a coding agent use a credential it cannot read, and how does that work in practice?

Yes. The agent names the credential by reference, and the environment supplies the real value where the agent is not. In Claude Code sandboxed commands see a sentinel and a local proxy substitutes the value for listed hosts, and in Docker a host proxy swaps a sentinel for the credential. The Read tool is outside the Claude Code sandbox, so keep the token out of files the agent can open, and note that calls to listed hosts still carry the real value and the token's scope.

Does not reading a credential make it safe to give the agent?

It makes the credential safer, not the authority. The agent can still ask for the credential to be used, and a misdirected agent can ask for a harmful use. Research found web-delivered attacks made multi-agent systems execute malicious code in most trials. Host lists, operation lists and approval by a named person decide how much the credential can do, and a record shows who authorized each use, which is what an auditor will ask to see.

What is a sentinel, and what happens if the sentinel itself leaks?

A sentinel is a placeholder value that stands in for the credential in a sandboxed command's environment. The command includes it in requests, and a proxy replaces it with the real value on the way out for approved hosts. If the sentinel leaks, nothing of value leaks. Claude Code and Docker both document sentinels, with the substitution happening at a proxy outside the command, so the command never holds the real value. Requests to listed hosts still carry it after substitution.

Where should the real value live relative to the agent that uses it?

As far from the agent as the workflow allows. A proxy on the developer's machine keeps it out of sandboxed commands and their output. A proxy on the host outside the sandbox, or an adapter on another host, keeps it off the agent's machine. The design question is whether the value ever touches the machine the agent runs on, and a security team should ask for the answer in writing for each tool in use, naming the host and the lifetime.

Does a proxy stop the agent from reading a token shown on a settings page?

No. A proxy governs outbound calls. If the agent works a token or settings page in a browser, the model reads whatever the page shows, so the page needs a separate control that replaces the value with a placeholder before the model reads it. A governed browser environment does that, and it does not cover a terminal, an IDE or MCP, so the controls are used together and each is tested on its own surface.

What should a security team ask for in writing about this?

Ask where the real value is supplied, what the agent sees in its place, which hosts or operations the substitution allows, who can change that list and who approves a consequential use. Ask what the model reads on any page where the credential appears. Treat anything the vendor does not document as unanswered, and ask for a dated answer from the vendor that names the credential and the workflow in question.

About the author

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

How RedactSure Lets an Agent Use a Credential by Reference Only

A proxy at the sandbox boundary keeps the value out of the agent's shell, but the token settings page the agent opens still renders it in the clear.

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Before: the model reads the real string on the token page; it can land in a commit, a transcript or an injected request. Inside the governed environment: the model reads GITHUB_TOKEN_01 on every page, and the real token resolves at GitHub only when the named person approves the save.

RedactSure is deploying now with enterprise and government customers. Adaptive attackers bypassed 12 published prompt injection defenses, most above 90 percent.

Everyone else controls where data can go. RedactSure controls what the AI can see.

See it on your own workflow

Using a credential by reference only helps if the agent can still finish the task. Bring a task that needs a real token and see, with test values, the agent complete it while the model reads only the placeholder. Book a demo

Book a demo

Book a demo

Having trouble? Open the booking page or email us.