ProxyKey MCP: Securing API Access for AI Agents Without Exposing Credentials
ProxyKey has launched an MCP server that lets AI agents such as Claude Code and Cursor control access to third-party APIs without ever receiving the actual credential. The project builds on the earlier observation that any credential visible inside an agent’s context must be treated as compromised because model outputs are logged, traced, and potentially exfiltrated through prompt injection.
The architecture separates three roles. The real provider key (secret) is submitted once through a web panel and stored encrypted with AES-256-GCM envelope encryption. A virtual token called a pass (prefixed vlt_) is bound to that secret and carries its own IP restrictions, rate limits, TTL, and request log. The proxy itself accepts the pass, decrypts the secret only for the duration of a single outbound request, and forwards the call transparently.
API calls change only the host and authorization header; path, body, and streaming behavior remain identical. Example:
- Original: curl https://api.openai.com/v1/chat/completions -H "Authorization: Bearer sk-…"
- Proxied: curl https://api.proxykey.org/p/openai/v1/chat/completions -H "Authorization: Bearer vlt_openai_…"
Telegram bots keep their familiar URL format: /p/telegram-bot/<pass>/getMe.
Agents connect to the MCP server over Streamable HTTP using a separate mcp_ token. Thirteen tools are exposed, none of which accept or return secret values. The catalog tools list providers and stored secrets (metadata only). Pass-management tools create, rotate, update, revoke, and monitor passes. Observability tools return request logs and statistics without exposing authorization headers or keys.
A key use case is the pending-secret flow. An agent can call create_pending_pass to obtain a pass immediately, embed it in configuration, and later hand a setup link to a human. Once the real token is entered through the web panel, the pass activates automatically without any further agent action. Throughout the entire lifecycle the secret never enters the model’s context.
The hosted proxy cannot be zero-knowledge because it must decrypt the secret in memory to forward the request. ProxyKey publishes its crypto module (proxykey-crypto) with tests and design notes covering nonce handling and key-wrapping choices. The service is positioned for environments where agents autonomously deploy services and bots; it is not intended for single, fully controlled keys or for workloads with strict sub-millisecond latency requirements.
Related articles
Deepfake Videos for Business Attacks Drop to Just $5 per Minute as AI Costs Plummet
The cost of creating convincing deepfake videos for attacks on companies has fallen roughly 100 times over the past two years. A single minute of high-quality fake video can now be produced for as little as $5, compared with several hundred dollars previously. The drop in prices was reported by Russian newspaper Izvestia, which also noted that underground marketplaces now sell ready-made templates that further reduce expenses. Lower prices significantly lower the barrier for criminals to conduct business email compromise and CEO impersonation scams. Experts warn that recognizable faces combined with urgent requests for wire transfers or credential sharing make traditional verification methods less reliable. Organizations are advised to confirm all financial instructions through an independent, pre-established channel rather than relying on video calls alone.
Over a Dozen AI Platforms Breached in One Month for API Keys in LLM-Jacking Operations
Between late September and early November, at least a dozen AI developer platforms were compromised in a coordinated campaign targeting API access tokens rather than customer data. Affected organizations include Andromeda, NVIDIA Brev, CommandCode, Fireworks AI, Lightning AI, Northflank, OpenCode, Railway, Trigger.dev, Warp, Zeabur, Chainstack, and WorkOS. Attackers exploited third-party components and internal sales applications to reach stored credentials used for AI inference services. The stolen tokens enable LLM-jacking and model distillation activities, with multiple threat groups observed reusing the same credentials shortly after disclosure. The open-source penetration testing framework Artex was used to automate reconnaissance and exploitation, lowering the barrier for less skilled actors. Companies such as Chainstack and WorkOS confirmed the incidents through their own disclosures, highlighting risks in non-core systems that store high-value AI credentials.
NIST Publishes Draft Taxonomy SP 2400-102 for Attacks on AI Agents
The National Institute of Standards and Technology released the first public draft of SP 2400-102 E2026 on 9 November 2026, extending its 2025 machine learning attack taxonomy with a dedicated chapter on AI agents. The document provides a common terminology for attacks targeting task formulation, planning, tool execution, and result interpretation stages. Attack goals include availability disruption through infinite tool calls, integrity violations that alter outputs or trigger unauthorized actions, sensitive data disclosure, and malicious agent misuse. Vectors range from direct user prompt bypasses and supply-chain model poisoning to indirect prompt injection via untrusted documents, persistent memory poisoning, compromised tools, and inter-agent message spoofing. NIST also examines layered defenses combining model-level detection of parasitic instructions with system-level restrictions, tool isolation, and human confirmation for high-impact operations. The draft references OWASP LLM03:2026 Excessive Agency and aligns with Russian standards GOST R 56939-2024 and GOST R 59276-2020 for testing and trust evaluation. Comments are accepted until 18 December 2026 before final publication.
Fake ITSM Tickets Allow Attackers to Trick AI SOC Agents into Dismissing Real Incidents
An experiment with the DeepSeek model showed that AI agents in Security Operations Centers can be reliably deceived by forged change-management tickets rather than classic prompt injection. Attackers with limited rights edit already-approved tickets in an ITSM system, changing the server and maintenance window while preserving the “Approved” status. The agent reads the ticket, matches the observed actions to the documented work, and automatically closes the alert. Human analysts reviewing the closed case later see only the reassuring link to the ticket and may also accept the decision. Three common LLM-based defenses—strict prompting, a secondary critic model, and supplying audit logs—either blocked too many legitimate changes or still allowed a quarter of attacks through. Only a deterministic code gate that cross-checks the ticket against immutable logs, role directories, and time windows achieved zero false closures on the test set while still automating 97 percent of genuine maintenance events.