Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

How Do I Run Several Coding Agents With Different Credentials?

Give each agent its own environment and its own grant on the shared repository, so a credential one agent holds is useless in the next agent's hands. Check where a shared credential and a shared screen would let one hijack reach the other agents' work.

A credential reference travels from a browser record through a bounded route to a separate API destination.

Two coding agents working one repository is the ordinary case now: one drafts a change, a second reviews it, a third runs the tests. Each needs a credential for the same remote, and the easy answer is to let them share one. That answer is also how a single injected instruction becomes several incidents, because a token four agents can read is a token four agents can carry away from the work. The record points to a per-agent grant that can be written and revoked on its own, since one shared credential collapses the boundaries between agents, and to a governed environment for the pages each agent reads, which the vendors' isolation designs leave open. One record type runs through the page: two CodeCells, each with its own grant, on one repository, and each section says which half of that record it describes. The scope note comes first, because the answer depends on which surface each agent touches. A browser control governs the rendered page. The terminal, the IDE, the local filesystem, direct API calls and MCP are different surfaces with different rules, and a team should decide which of them each agent may use before the run starts.

Key findings

  • The hijack this page guards against is measured: a study of prompt injection against agentic coding editors reports that "attack success rates can reach as high as 84% for executing malicious commands" (Liu et al., 2026).
  • A detector is not a boundary: adaptive attackers bypassed 12 published defenses with an "attack success rate above 90% for most," many of which had reported near-zero rates (Nasr et al., 2025).
  • Least privilege governs the credentials and the actions an agent is given; it does not govern the screen, where values are replaced with tokens before any model reads the page (What Is Least Exposure?).
  • Real values resolve only at the approved destination at the moment of an approved action, and that approval belongs to the person who set the agent up rather than to the agent (What Is a Tethered Agent?).
  • Anthropic's Claude Code documentation states that "the boundary is a permission prompt, so a Bash command you approve can still write anywhere your user account can," which is a limit on what an approval covers (Anthropic, Security, 2026).
  • OWASP's non-human identity list describes credential leakage as "leakage of sensitive NHIs such as API keys, tokens, encryption keys, and certificates to unsanctioned data stores," and lists overprivileged identities as a separate risk (OWASP, 2025).

What does one agent's credential boundary cover, and what is outside it?

The scope comes first because the title says coding agents and the answer depends on the surface. A governed browser environment covers what an agent reads and does on a rendered page: dashboards, consoles, repository pages and settings pages. It does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP. An agent that pushes from a shell with a deploy key in its environment is outside a browser control. An agent that opens a repository's access settings page and reads the token list is inside it.

The record type for this page is two CodeCells with two grants on one repository. The first cell renders the repository's access settings page, where deploy keys, fine-grained tokens and collaborators are listed. The second renders a pull request page of the same repository. Each cell's adapter holds its own grant, scoped to one repository and one operation, so neither cell's model can present the other's credential.

That split is what makes the question answerable. A grant is authority, and authority divides cleanly: this cell may open a pull request, that cell may read the checks. What a model reads on the page is a different quantity. The settings page renders the same token list to whichever agent opens it, so dividing grants does not by itself divide exposure. The rest of this page keeps those two quantities apart.

Anthropic's Claude Code documentation states that it can "sandbox bash commands with filesystem and network isolation, reducing permission prompts while maintaining security," a boundary drawn around commands rather than around the credentials an agent is given (Anthropic, Security, 2026).

Why does one shared credential make a hijack worse?

The reason is arithmetic. A credential shared by three agents has three places to leak from, one set of logs that shows the same identity for all of them, and one revocation that stops all three when it stops the attacker. When the credential belongs to one agent, a leak has one owner and a revocation costs one run.

The measured case is the agentic coding editor, where "attack success rates can reach as high as 84% for executing malicious commands" (Liu et al., 2026). Web-delivered attacks made GPT-4o multi-agent systems execute malicious code in 58 to 90 percent of trials, with some configurations at 100 percent, as How Do You Protect Sensitive Data Across Multiple AI Agents? records. In a measured study of generalist web agents, an injection delivered through the environment took a person's specific personal information at a rate as high as 70 percent (Can an AI Agent Sign Up for Developer Services Without Seeing Your Payment Card or Identity?).

Cursor's own documentation states that "AI can behave unexpectedly due to prompt injection, hallucinations, and other issues," which is a warning about the model's judgment rather than about the scope of the credential it holds (Cursor, 2026). A shared token turns that warning into a shared failure.

Truffle Security reported that "11,908 Live Secrets were detected using TruffleHog in 400TB of web data," and that "2.76 Million Web Pages contained live secrets" (Truffle Security, 2025). A credential that reaches the open web is a credential anyone can test; one that reaches a second agent is a credential the second agent can spend.

What do the vendors themselves say?

Five vendor pages describe where a credential boundary is drawn around an agent, and each draws it in a different place, so each is cited for its mechanism and its limit.

Cursor's documentation states that "by default, terminal commands need your approval" and that "all MCP connections need your approval," and how credentials are stored or protected in the session it governs is not described in the pages reviewed (Cursor, 2026).

Anthropic's Claude Code documentation states that "GitHub credentials are stored encrypted on Anthropic's servers and never enter the session VM. The VM holds a short-lived credential scoped to that session," which is a per-session credential for its hosted cloud sessions rather than a per-agent grant on a developer's machine (Anthropic, Security, 2026).

HashiCorp's response wrapping documentation states that "a new single-use token is generated with the TTL supplied by the client," and that "Vault currently does not provide signed response-wrapping tokens, as it provides little extra protection" (HashiCorp, 2026).

Firecracker's design documentation states that it "is designed to assure secure isolation using multiple layers," and that "all egress traffic from a guest is therefore considered untrusted, and should be filtered at the host-level," which separates guests and says nothing about what a guest's model reads on a page (Firecracker, 2026). Microsoft's managed identity documentation states that "managed identities eliminate the need for developers to manage these credentials" and that "this token acquisition doesn't require any secrets," a per-resource identity rather than a string an agent holds (Microsoft, 2026).

Dimension What the documentation reviewed states What a buyer should verify
Unit of isolation One virtual machine per Firecracker guest; one session VM per Claude Code cloud session Whether each agent gets its own unit or shares one
Credential lifetime Single-use wrapping token with a client-supplied TTL; a credential scoped to one session The maximum lifetime and what ends it early
Approval boundary Terminal commands and MCP connections need approval by default in Cursor; a permission prompt in Claude Code Which actions bypass the prompt, and who may approve
Guardrail framing Cursor calls its run modes "best-effort guardrails rather than a hard security boundary"; Claude Code says the protections "significantly reduce risk" Whether the guardrail is the boundary or a layer in front of it
Credential storage Encrypted on Anthropic's servers for its cloud sessions; not described for Cursor's agent session Where the value lives and who can decrypt it
What the model reads Not addressed on these pages Whether values are replaced before the model reads them
Record Not described as a per-run export on these pages What the record holds and where it goes

How do you write a grant for one agent and revoke it after the run?

A per-agent grant has four fields: what it may act on (one repository), what it may do (one operation, such as opening a pull request), how long it lasts (one run), and who holds it (one cell's adapter). What changes with several agents is the unit: the grant is written per agent rather than per team.

An agent that reads a token in order to use it has already put the value into a context that logs, summarizes and repeats what it holds. The arrangement that avoids that is older than agents: the agent names a credential, and a component outside its process attaches the real value to the request. GitGuardian's data, as reported by Help Net Security, counted "28,649,024 new secrets exposed in public GitHub commits across 2025," with commits co-authored by an AI coding agent leaking credentials at roughly double the baseline rate, and "24,008 unique secrets exposed in MCP configuration files" (How Do You Let an AI Agent Manage API Keys Without Reading Them?).

Revocation is the half that is easy to design and hard to prove. A grant that lasts one run needs no rotation schedule: the run ends, the grant dies, and the next agent starts with a new one. A root access key is the opposite, durable and top-level and carried by everything that holds it, which is why the guidance on that page rules it out (Is It Safe to Let an AI Agent Set Up Your Cloud Environment?).

The test is to revoke one cell's grant mid-run and watch what stops. If the other cell's work continues and only the revoked cell's page fails, the grants are separate. If both stop, the agents were sharing a credential.

Where does a shared screen defeat separate credentials?

Separate credentials answer the authority question and leave the exposure question standing. Two agents on one repository often read the same rendered pages: the access settings page, the token list, the collaborators list, the audit log. Each agent's grant may be narrow, and the page still shows every key the repository holds, because the page was rendered for a person who is allowed to see them.

A detector layer does not close that gap. The LlamaFirewall paper describes "PromptGuard 2, a universal jailbreak detector that demonstrates clear state of the art performance," and its abstract gives no quantitative results, so a detector is a layer whose failure rate a buyer has to measure rather than a boundary (Chennabasappa et al., 2025). A detector in front of each agent is one more thing that has to work every time.

The exposure question is about what each agent's model receives when the page is drawn. A page can be rendered for an agent with values replaced, so the token list reads as a list of placeholders and the collaborator list as names the model cannot resolve. That control sits on the render path, before the model, and it is the same control regardless of which grant the agent holds. Excessive agency, where one login leaves an agent holding more permission than its task needs, is fixed by dividing the grant; the exposure of the page it reads is fixed only at the page (How Do You Give AI Agents Access to Workflows Without Exposing Sensitive Data?).

If both agents read the same token list in full, the grant design is doing half the work.

What does a governed environment change?

A governed environment is a control class that acts where a screen is rendered, before any model reads it. Values chosen by policy are replaced with tokens that stay consistent for the whole run, so a repository settings page shows CRED_002 where a credential value would be, on the first page and on the fortieth. Real values resolve only at an approved destination, at the moment of an approved action. A named person confirms the tokenization policy and approves each consequential action, and a pull request, a merge, a permission change and a payment are each consequential. Every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.

For this page's question it supplies the quantity that per-agent grants leave out. Grants divide authority; a governed environment divides exposure, so two agents on one repository can hold separate grants and still never read the same real value. The record makes the division checkable, because it names which cell opened which page, what the model received there and who approved the action that followed.

It also changes what revocation means. Revoking a grant removes authority an agent no longer needs, and the record shows what was done with that authority while it lasted. A team running several agents therefore gets two independent answers about what a compromised agent could reach: the grant limits what it may do, and the render layer limits what it ever held.

The scope of the control is the rendered page. A credential used by a shell command, a file read in the tree, an IDE plugin or a direct API call is governed by the grant and by whatever else the team puts around that surface. That limit is worth stating plainly, because a team that assumes otherwise will believe it has covered a terminal it has not.

Methodology and limitations

This page rests on three research preprints on prompt injection against coding agents and on adaptive attacks, vendor documentation from Anthropic, Cursor, HashiCorp, Firecracker and Microsoft, OWASP's non-human identity risk list, one vendor research post, and existing RedactSure research pages on least exposure, tethering and multi-agent exposure. Vendor pages were read as of October 20, 2026, and each Sources line carries the date for its page. Quoted facts are cited to the page that states them, and the research abstracts are cited for what they state rather than for figures they do not give.

RedactSure did not test any of the named products hands-on. Where this page says a behavior is not described, it means the vendor pages reviewed for it are silent, and a feature released after the read date should be treated as unreviewed; vendor features change and the page carries its date. Statements about RedactSure describe its current design, and RedactSure is deploying now with enterprise and government customers. The record scenario describes a record type, two CodeCells with two grants on one repository, and not an organization, and no real repository, token or account is described.

Determinations about whether a credential arrangement satisfies a contractual, identity-provider or regulatory requirement belong to counsel, assessors and the organization's own security and compliance officers. The page states mechanisms as the cited pages describe them and offers no opinion on whether a particular vendor's arrangement is adequate for a particular organization. Nothing here replaces a test of the organization's own agents against a test repository, repeated after each vendor release and after each change to the grant design.

What the record shows

The vendors answer the authority half of the question and leave the exposure half open. Firecracker separates guests and filters egress at the host; HashiCorp issues a single-use token with a client-supplied lifetime; Anthropic keeps a scoped credential in a session VM for its hosted sessions; Microsoft removes the credential from the workload entirely. Each of those designs divides what an agent may reach, and none of the pages reviewed describes what the model reads on a page the agent renders. The research record says why the boundary has to be drawn before the run: injection against coding editors reaches 84% in the reported trials, and adaptive attacks bypassed most published defenses. The practical test names one agent and one repository page and asks two things: what that agent's model received on the page, and which grant signed the action it took.

Frequently asked questions

How do I run several coding agents with different credentials?

Give each agent its own environment and its own grant, then keep the value out of the agent's hands. In practice that means one sandbox or cell per agent, one grant scoped to one repository, one operation and one run, and a credential the agent names rather than reads. The agents can work the same repository at the same time because the authority is divided per cell. The check is whether revoking one cell's grant stops the other cells' work; if it does, they share a credential.

Can several agents share one credential safely?

Only if the team accepts that the credential's blast radius is every agent that holds it. A shared token means one leak, one set of logs showing a single identity, and one revocation that affects all of them, and it makes attribution impossible after an incident because every action carries the same principal. If sharing is unavoidable for a short period, shorten the lifetime, cut the scope to the one repository the agents need, and plan the move to per-agent grants.

What is a per-agent grant?

A per-agent grant is a credential written for one agent's run. It names the repository, the operation, a lifetime that ends with the run and the component that may present it. The fields are the ones a cloud team already uses for a service identity; what changes is the unit, which is now the agent rather than the team. A second agent needs a second grant even when both work on the same repository, and neither grant can be presented by the other cell.

Does a separate sandbox give each agent a separate credential?

No, and the gap is worth checking. A sandbox separates files and processes; it does not decide what credential the agent inside it holds, and teams often mount one shared token into every sandbox because it is convenient. The separation counts only when the credential is minted per sandbox and cannot be read from inside it. Ask which of the two a tool does before counting the sandbox as a credential boundary, then ask whether the credential outlives the run.

How do I know which agent used which credential?

Only if the action carries an identity that names the agent or its grant. Where every agent signs with one token, the provider's log shows one principal and the team is left reconstructing agents from timestamps. A per-agent grant with a short life gives each run a distinct principal to look up, and a record of what each model read on the page gives the other half of the account, which the provider log never contains.

What should I ask a vendor in writing?

Whether the credential is minted per agent and per run, where the real value lives, and what the model receives on a page that lists credentials. Ask how revocation works mid-run, what the record shows, and whether one agent's approval can authorize another agent's action. Ask which surfaces the control covers, since a browser control does not govern a terminal, an IDE or a direct API call. An answer that is not written down is a claim, not a control.

About the author

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

How RedactSure Keeps Two Agents' Credentials Apart on One Repository

Per-agent grants settle what each agent may do but leave what each agent reads undivided, and that needs one rendered view per agent.

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Before: both cells read the access settings page in full, so each token sits in two contexts. Inside the governed environment: both cells read CRED_002 and CRED_003, and the real value reaches only the destination the approver named.

RedactSure is deploying now with enterprise and government customers. Adaptive attackers bypassed 12 published defenses with an "attack success rate above 90% for most."

Everyone else controls where data can go. RedactSure controls what the AI can see.

See it on your own workflow

Two agents working on one repository should never be able to read each other's tokens. Bring two tasks that share a repository and see, with test values, what each agent's model reads on the same page. Book a demo

Book a demo

Book a demo

Having trouble? Open the booking page or email us.