- A secret typed into an agent can end up in the model prompt, the memory database, the traces and the evaluation tables. Each is a separate place to leak.
- Gaggar said Credit Karma's framework blocks and redacts secrets above a roughly 90% severity score. The excerpts we reviewed show no test of it, so it is worth testing.
Harish Gaggar of Intuit Credit Karma said on the AI Engineer show that a secret typed into an agent must be kept out of the model, the memory database, the tracking and evaluation tables, and the tracing systems. WebPulse's argument is that this list is long because an agent copies its input into several stores. Each store is a separate place to leak.
What was said
Gaggar's talk described the supporting controls an agent needs before production. He said that "there are many agents, uh, uh, generally get failed in productions because their foundation controls are missing." He named secret handling among those controls. He asked whether a team has protection in place so that secrets do not go into the model, tracking, tracing or any memory database.
He explained how the risk starts. A user may upload a document with sensitive details. Someone may also paste an API key while typing a question.
His team's answer is a framework that defines types of data and gives each a severity level. Gaggar said that when severity is above roughly 90%, the system blocks and redacts the secret. He described the aim as stopping sensitive data at the instant it is ingested, as the user types.
Why it matters
Our reading: the lesson is about count, not cleverness. A simple web form leaks a secret in a few places. An agent can copy its inputs into prompts, long-term memory, step-by-step traces and quality scores. Each copy is something a team must inspect, retain and protect.
For buyers and builders, this suggests a plain question to put to any agent project. Can you list every store that sees user input, and does the secret filter sit in front of all of them? Gaggar's list is a handy starting inventory.
The other side
A threshold is a judgment call. The excerpts do not say how the severity scores are produced. They also do not say what happens to data that scores below the cutoff, or how often the filter misses a real secret. A key in an unusual format could slip through.
The only demo in the excerpts covered something else: a context optimizer that cut one query from about 24,000 tokens to about 2,400. The excerpts show no test of the secret filter. Gaggar's account is a design described by one company, not proof that the filter works. Teams that copy it should try to break it first.
Written by the WebPulse Newsroom with AI assistance, and checked by our editorial review: every quotation was verified against the recording's transcript. How we use AI.
The conversation this talking point comes from
- AI Engineer: Paving the Road to Production: Governed Enterprise AI Agents — Harish Gaggar, Credit Karma (2026-10-14)
