TRM Labs has open-sourced Gatehouse, a credential proxy that lets AI agents call approved services without holding the real keys. The approach gives teams a way to limit what an agent can access, even if hostile instructions try to make it leak credentials.
Watch Desk analysis
What happened
TRM says Gatehouse keeps secrets in an external secrets manager and gives agents placeholders instead. The proxy checks each request against a reviewed catalogue, adds the real credential only when the destination and request are approved, and logs the attempt. TRM says its agents use the system with Cursor self-hosted workers and Claude Code in a shared sandbox.
The company describes safeguards including blocking unapproved destinations and refusing to forward credentials if the audit record cannot be written. Its open-source version is based on Infisical’s Agent Vault, with TRM adding features including database and browser brokers, identity checks and a reviewed access catalogue.
Why it matters
An AI agent does not need to be persuaded to reveal a secret if it never receives one in the first place. Gatehouse moves that protection outside the model: people control permissions in reviewed code, while the proxy handles credentials as requests pass through it.
That is a practical security pattern for organisations connecting agents to databases, APIs and other systems. It does not limit what an agent can learn from an approved service’s response, so access still needs to be scoped carefully.
Our read
This is a concrete attempt to solve a real agent-security problem with infrastructure rather than a stern note asking the model to behave. The useful idea is separation of access from authority: agents can make approved requests, but they do not get handed a bundle of keys and wished good luck.
Teams considering it should start with the access catalogue and the services their agents genuinely need, not treat a proxy as a substitute for least-privilege design.
What to watch
- Whether the open-source project gains adopters and contributions beyond TRM.
- How its catalogue and identity checks work across more agent platforms and services.
- Whether the planned use of fresh credentials for each call becomes available.
Discussion spark: Would you trust a proxy to manage an agent’s access to company systems, or should agents remain disconnected from sensitive services altogether?
Sources and evidence
- How TRM Keeps Credentials Away From AI Agents | TRM Tech Blog – TRM Labs (29 October 2026, 17:08 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.