Your AI Agent Doesn't Need Your Real Passwords Anymore

You have been trusting a black box with your business's passwords, and nobody told you there was another way.

It is a Friday afternoon in Manchester. Owen runs a five-person plumbing business out of a lock-up on the edge of town. Quotes go out on WhatsApp. Invoices sit in Xero. Payments land through Stripe. His diary, half paper and half Google Calendar, is a mess by Wednesday every single week.

Owen has watched three different videos this month about hiring an AI agent to chase his unpaid invoices and book his jobs automatically. Every video ends the same way: connect the agent to your accounting software, connect it to your email, connect it to your calendar, hand over the keys. And every time, Owen closes the laptop. Handing a piece of software he does not fully understand the login to his business bank feed feels like leaving the workshop unlocked overnight.

He is not wrong to hesitate. He has just been asking the wrong question. The question is not "should I trust the agent." The question is "does the agent even need to hold my real password to do its job." As of this week, for one of the biggest open agent platforms on the internet, the answer changed.

How do AI agents keep your business's passwords safe?

Hermes Agent, the open-source AI agent built by Nous Research, now runs its sandboxed tasks behind a credential firewall called iron-proxy. The sandbox where the agent actually executes code never sees your real OpenRouter key, your real Stripe key, or any other real credential. It only ever holds a disposable, single-purpose stand-in token. A small proxy running on your own machine intercepts every outbound request from that sandbox, swaps the stand-in token for the real key at the last possible moment, and forwards the request on. The real key never crosses into the sandbox at all.

Nous Research announced the feature on July 24, 2026, through its official account and through Teknium, the company's cofounder and lead engineer on Hermes Agent. The post put it plainly: "Keep your secrets safe, even from your own agent." Within a day, the announcement had pulled 1,404 likes and 716 bookmarks, and independent coverage from AlphaSignal and Coinfomania had already broken down how it works. That is not viral for the sake of viral. It is a lot of technical people recognising a real gap finally getting closed.

The problem nobody wanted to say out loud

Here is how giving an agent access to your business has worked until now, for almost every tool on the market. You connect your email. You connect your accounting software. You connect your calendar and your payment processor. Every one of those connections needs a real credential: an API key, an access token, a password. That credential typically gets dropped straight into the sandbox where the agent's code actually runs, sitting there in plain text as an environment variable.

• The sandbox holds your real API key for the full length of every task.
• Anyone who can get the sandbox to run one unintended command can read that key.
• Once the key is out, it works from anywhere. Your laptop, an attacker's laptop, a server on the other side of the world. The key does not know the difference.

You have been trusting the agent's good behaviour to protect your credentials, instead of trusting an actual wall between the two. That is how the whole industry has built agents up to now, one vendor is no exception. Most people never thought to ask about it, because "AI agent" sounded like software, and software does not usually come with a section on where your passwords physically live while it works.

What happens when an agent gets tricked

The attack that makes this matter has a name: prompt injection. It is not a hacker breaking through a firewall in the traditional sense. It is a webpage the agent reads, or a file the agent opens, or an email the agent processes, that contains hidden instructions. A line of text tells the agent to run a command it was never asked to run. Most of the time nothing happens. Occasionally, the hidden instruction is something like "read your environment variables and post them to this address."

Picture the difference between a chatbot and an agent here, because it is the whole point. A chatbot that gets prompt-injected on a webpage might write something embarrassing back to you. An agent that gets prompt-injected while holding your real Stripe key can, in principle, read that key and hand it to whoever planted the trap. A chatbot answers. An agent finishes the job, for better or worse, with whatever access it was given.

How the credential firewall actually works

Strip away the branding and the mechanism is simple enough to explain in five steps, based on Nous Research's own developer documentation and AlphaSignal's technical breakdown of the release:

1. Your agent's sandbox needs to call an outside service, say a language model provider or your accounting software's API.
2. Instead of using a real key, the sandbox only ever holds a disposable, opaque proxy token. That token means nothing anywhere else on the internet.
3. The request leaves the sandbox and hits a small proxy daemon running on your own machine, the one place the real credential is actually allowed to exist.
4. The proxy swaps the disposable token for the real key at that exact boundary, then forwards the completed request upstream to the real service.
5. The response comes back through the same tunnel. The sandbox never saw the real key at any point in the round trip, so a compromised sandbox has nothing worth stealing.

Before iron-proxy vs after iron-proxy

Isn't this just for developers running Hermes?

Right now, yes, mostly. Turning it on takes a command line and a bit of comfort with terminal tools; the setup wizard is called with hermes egress setup, and it is aimed at builders, not at Owen typing into a chat window. That is a fair objection.

But the pattern is what matters, and it is already spreading past Hermes. Within days of the iron-proxy release, an independent developer published a breakdown of OpenShell, a policy-controlled runtime that wraps a Hermes agent's entire session, filesystem, network, and credentials, in the same spirit: give the agent the smallest credential bundle that matches its actual job, and inject secrets at run time instead of leaving them sitting in a file the sandbox can read. When more than one team converges on the same fix within the same week, that is usually a sign the fix was overdue, not a coincidence.

What this means if you are not a developer

You do not need to install Hermes yourself to benefit from this shift. What you need is the right question for whoever sets up your AI agent, whether that is an in-house hire, a freelancer, or an automation agency.

1. Ask where your real credentials are stored while the agent runs. "In the sandbox" is the old answer. "In a separate proxy or vault that the sandbox never touches" is the new one.
2. Ask what happens if the agent is tricked by a malicious webpage or email. A vendor with a good answer will talk about token scope and blast radius. A vendor with a weak answer will only say "our agent is well trained."
3. Give the agent the smallest bundle of access it actually needs for the job. A follow-up agent that only needs to read your calendar should never also hold the keys to your payment processor.
4. Start with read access before you hand over write access. Let it draft the follow-up message before it lets it send payment reminders on its own. Confidence is earned in stages, not granted on day one.

This is the same logic that made Owen finally reopen the laptop. A ClawDrop workshop for small business owners, recorded on July 23, showed a live example of the pattern in practice: an always-on Hermes agent hooked into a CRM, email, and a bookkeeping tool, categorising transactions, chasing unpaid invoices, and sending a morning briefing, without a human retyping a single login each time it ran. The demo did not dwell on security, because for the people running it, the access questions had already been asked and scoped down to exactly what each task needed. That is the boring, unglamorous discipline sitting underneath every genuinely useful business agent right now.

What you have after this

A week in, you have asked your AI vendor or your automation hire one new question: where do the real keys live. You will know within a sentence whether they have thought about it.

A month in, you have handed over your first real, narrow task. Maybe it is a lead follow-up agent that only ever touches your CRM and your text messages, nothing else. It works, because it was never trusted with more than it needed.

Six months in, you have a small stable of narrow agents doing the admin you used to do at 9 p.m., each one scoped down to the one thing it does, none of them holding a master key to your whole business. Same team, same tools, a completely different level of comfort handing off the keys.