Google's agent design keeps real credentials out of the AI's hands

Philipp Schmid of Google DeepMind called credentials the most exciting feature of Google's Managed Agents API. His team's design keeps the real secret away from the agent. He spoke on the AI Engineer show, in an episode about seven things an AI coworker needs.

What was said

Schmid said credentials are "super hard and super easy to get wrong with agents." His team's answer is to keep them outside the agent's own sandbox, the isolated computer where it works. Credentials are written once and cannot be read back. They can only be overwritten. Schmid said this removes the possibility of leaking them.

A network proxy does the rest. He described it as a proxy that sits around the sandbox and watches all traffic going in and out. The owner ties each credential to a domain or an environment variable, which is a named setting the agent's tools read. Inside the sandbox, Schmid said, "the model has a local dummy value." When the agent calls an approved domain, the proxy swaps the dummy for the real credential. The agent gets its result and never knows its token was fake.

Schmid used prompt injection as the threat. That is when an attacker hides instructions in content the agent reads. A typical one asks the agent to print every value in its settings file. With only dummy values in place, that request exposes nothing useful. He said there is "no way an MCP server, which is malicious, can just steal your Gmail token." An MCP server is a plug-in tool the agent connects to.

Why it matters

Our reading: the most important feature of an AI coworker may be that the agent never holds the real secret. This design accepts that agents will sometimes be fooled and shrinks what a fooled agent can lose. Schmid's scenario shows the risk. Without a proxy, an injected instruction to print the settings file could expose real keys. A hard-to-leak secret does not depend on the agent behaving well. Schmid said this makes it easier to trust an agent and to connect outside tools. For managers buying agent products, a useful question is where the real credentials live, and who decides which domains may receive them.

The other side

Schmid's claim is about stealing credentials. It does not stop a tricked agent from misusing an approved connection. The proxy swaps the real secret in for a permitted domain whatever the agent was told to do. Schmid did not claim otherwise. He described other layers, including hooks that guard certain commands or require human approval. He said the agent cannot edit those hooks. He also said "if that's not enough," which suggests he sees the proxy as one layer. The excerpts did not cover how well any of this works in practice, or how it compares with other vendors' approaches.