ProxyKey MCP: Securing API Access for AI Agents Without Exposing Credentials
ProxyKey has launched an MCP server that lets AI agents such as Claude Code and Cursor control access to third-party APIs without ever receiving the actual credential. The project builds on the earlier observation that any credential visible inside an agent’s context must be treated as compromised because model outputs are logged, traced, and potentially exfiltrated through prompt injection.
The architecture separates three roles. The real provider key (secret) is submitted once through a web panel and stored encrypted with AES-256-GCM envelope encryption. A virtual token called a pass (prefixed vlt_) is bound to that secret and carries its own IP restrictions, rate limits, TTL, and request log. The proxy itself accepts the pass, decrypts the secret only for the duration of a single outbound request, and forwards the call transparently.
API calls change only the host and authorization header; path, body, and streaming behavior remain identical. Example:
- Original: curl https://api.openai.com/v1/chat/completions -H "Authorization: Bearer sk-…"
- Proxied: curl https://api.proxykey.org/p/openai/v1/chat/completions -H "Authorization: Bearer vlt_openai_…"
Telegram bots keep their familiar URL format: /p/telegram-bot/<pass>/getMe.
Agents connect to the MCP server over Streamable HTTP using a separate mcp_ token. Thirteen tools are exposed, none of which accept or return secret values. The catalog tools list providers and stored secrets (metadata only). Pass-management tools create, rotate, update, revoke, and monitor passes. Observability tools return request logs and statistics without exposing authorization headers or keys.
A key use case is the pending-secret flow. An agent can call create_pending_pass to obtain a pass immediately, embed it in configuration, and later hand a setup link to a human. Once the real token is entered through the web panel, the pass activates automatically without any further agent action. Throughout the entire lifecycle the secret never enters the model’s context.
The hosted proxy cannot be zero-knowledge because it must decrypt the secret in memory to forward the request. ProxyKey publishes its crypto module (proxykey-crypto) with tests and design notes covering nonce handling and key-wrapping choices. The service is positioned for environments where agents autonomously deploy services and bots; it is not intended for single, fully controlled keys or for workloads with strict sub-millisecond latency requirements.
Related articles
Zscaler Report Details How Generative AI Accelerates Custom Malware Creation and Social Engineering
Zscaler published an analysis on October 16 examining the use of generative AI by attackers for social engineering, data discovery, and malware development. Principal security researcher Phil Hagen notes that the report focuses on broad methods rather than naming specific malware families or confirmed campaigns. The core observation centers on the dramatically increased speed at which malicious scripts can be written and iteratively revised. Traditional detection that relies on matching files or traffic against known patterns loses effectiveness when code is frequently altered while preserving the same functionality. The analysis clarifies that observed rapid creation and revision does not equate to fully autonomous self-mutating malware that changes on every execution. Another impact is the disappearance of classic indicators such as spelling and grammar errors in phishing messages, which previously helped identify malicious intent. Zscaler recommends focusing on behavioral analysis of what programs actually do rather than solely relying on matches to previously catalogued samples.
AI Agents Using Claude and Grok Fully Automate Attacks on 400 Latin American Financial Institutions
A Straiker investigation has revealed that the CyberCartel hacking group built an AI agent network driven by multiple large language models to conduct fully automated attacks against more than 400 Latin American banks and payment applications. The system incorporates models from Anthropic and xAI, with CrowdStrike confirming additional use of DeepSeek. The AI agents independently perform reconnaissance across hundreds of targets, steal credentials through adaptive techniques, take over accounts while mimicking human behavior to evade detection, and monetize stolen data with minimal human intervention. This development marks a sharp drop in attack costs, allowing scalable operations that were previously impractical due to high manual effort. Defenders are advised to deploy dynamic behavioral baselines, enforce zero-trust architectures, strengthen multi-factor authentication and transaction monitoring, and incorporate AI adversary simulations into red-team exercises. The report is described as one of the first detailed public records of such end-to-end AI-driven financial attacks.
Registration Opens for SOC Forum 2026 with Focus on GenAI and Cybersecurity Risks
GC Solar has opened registration for SOC Forum 2026, the central event of the Russian Week of Cybersecurity. The two-day conference will take place on 27-28 October at the Lomonosov cluster in Moscow and will examine both the economic benefits and the security challenges of generative AI. Day one covers business impact, regulatory questions, data control, liability for AI errors, and new threat vectors. Day two shifts to hands-on technical tracks covering attack detection, defensive infrastructure development, and the use of AI by both attackers and defenders. The program includes dedicated tracks such as AI & Cybersecurity, Offence, Defence, and SOC-practicum. Organizers emphasize practical discussions over marketing presentations about neural-network images.
AI Investigators in SOCs: Limits of Autonomy, Prompt Injection Risks, and the Cost of Over-Reliance
A February 2026 Vectra AI survey of 1,450 security professionals revealed that organizations receive nearly 3,000 daily attack alerts on average, with 63% left unprocessed and 71% of respondents delaying critical tasks at least two days a week. The article examines the push to deploy autonomous AI agents for investigations in Security Operations Centers, highlighting how such systems often fail when confronted with real-world disorder such as inconsistent server timestamps, unapproved software installations, and incomplete logging. It stresses strict limits on AI decision-making authority, especially for blocking systems or revoking access, and warns against treating model confidence scores as reliable error probabilities. Prompt injection attacks via malicious emails, logs, or documents are identified as a novel threat that can manipulate language models into ignoring attacks or leaking data. Research from Microsoft involving 167 analysts showed that false “safe” verdicts from AI increased missed threats by 29 percentage points. The piece concludes that independent human verification of AI-closed cases remains essential to avoid hidden risks behind empty alert queues.