[HN Gopher] Secure Secrets Management for Cursor Cloud Agents
___________________________________________________________________
Secure Secrets Management for Cursor Cloud Agents
Author : vmatsiiako
Score : 37 points
Date : 2026-03-10 02:43 UTC (4 days ago)
(HTM) web link (infisical.com)
(TXT) w3m dump (infisical.com)
| rossjudson wrote:
| Can create security risk "if you're not careful?"
|
| The security risk is created if you're careful or not. The best
| you can do is reduce the size of the fresh attack surface you're
| creating.
|
| https://infisical.com/blog/secure-secrets-management-for-cur...
| jossclimb wrote:
| This sounds like the approach the nono project took: it injects a
| phantom token, so the sandboxed agent never gets to see the real
| key, it has a session scoped, time limited dummy key
| https://nono.sh/docs/cli/features/credential-injection
| tanbablack wrote:
| This is a really important area to tackle. secret management for
| AI agents is something most teams are ignoring right now.
|
| One adjacent risk worth noting: the URLs these agents visit
| during research. Even with proper secret management, if an agent
| browses a poisoned page during research, the injected
| instructions could override its behavior before secrets ever come
| into play.
| derefr wrote:
| > if an agent browses a poisoned page during research, the
| injected instructions could override its behavior before
| secrets ever come into play.
|
| Why is this problem (UGC instruction injection) still a thing,
| anyway? It feels like a problem that can be solved very simply
| in an agentic architecture that's willing to do multiple calls
| to different models per request.
|
| How: filter fetched data through a non-instruction-following
| model (i.e. the sort of base text-prediction model you have
| before instruction-following fine-tuning) that has instead been
| hard-fine-tuned into a classifier, such that it just outputs
| whether the text in its context window contains "instructions
| directed toward the reader" or not.
|
| (And if that non-instruction-following classifier model is in
| the same model-family / using the same LLM base model that will
| be used by the deliberative model to actually evaluate the
| text, then it will inherently apply all the same "deep
| recognition" techniques [i.e. unwrapping / unarmoring /
| translation / etc] the deliberative model uses; and so it will
| discover + point out "obfuscated" injected instructions to
| exactly the same degree that the deliberative model would be
| able to discover + obey them.)
|
| Note that this is a strictly-simpler problem to that of
| preventing jailbreaks. Jailbreaks try to inject "system-prompt
| instructions" among "user-prompt instructions" (where, from the
| model's perspective, there is no _natural_ distinction between
| these, only whatever _artificial_ distinctions the model 's
| developers try to impose. Without explicit anti-jailbreak
| training, these are both just picked up as "instructions" to an
| LLM.) Whereas the goal here would just be to prevent any UGC-
| tainted document containing anything that could be recognized
| as "instructions I would try to follow" from ever being
| injected into the context window.
|
| (Actually, a very simple way to do this is to just take the
| instruction-following model, experimentally derive a vector
| direction within it representing "I am interpreting some of the
| input as instructions to follow" [ala the vector directions for
| refusal et al], and then just chop off all the rest of the
| layers past that point and replace them with an output head
| emitting the cosine similarity between the input and that
| vector direction.)
| jFriedensreich wrote:
| If i read this correctly its completely absurd. secrets can never
| even touch an agents sandbox, not as file not as env var not as
| anything. Agents can only be allowed to reach services via
| proxies that handle secrets and do permissions and auditing
| completely transparently and agents do not even get secrets to
| access these but authenticate as their identity eg with client
| certificates. I am not aware of any other method that could work.
| The proxies obviously also cannot be reachable outside the direct
| connection, so if agents exfiltrate their identity and proxy
| setup somehow the usefulness outside is zero.
___________________________________________________________________
(page generated 2026-03-14 23:01 UTC)