Here’s a question Ridge Security has been digging into: Can an agent use a secret, like a password or token, without its underlying LLM ever having to see that secret?
Ridge’s answer is yes – but getting there means confronting a real problem with how agents are typically built today.
If a pentest agent’s LLM sees raw secrets, that value doesn’t stay contained to one conversation. It can leak into debug logs, error reports, caches, retries, or saved reports. And once it’s already in the LLM’s context, it’s too late to filter out. It also widens the attack surface, since the value now passes through model infrastructure and becomes a target for prompt injection, where a malicious input could trick the agent into repeating or leaking it.
Ridge’s security team argues the fix isn’t a better filter, it’s a different architecture. They call it a “Security Harness”: the agent gets permission to use a secret without the LLM ever being shown the secret itself. The real credential stays behind a trusted boundary, and the model works with a safe reference it can reason about and use only when an authorized action calls for it. They lay out the thinking, and how it could work, in this recent blog post.
The core idea, as they put it: just because an agent is authorized to use a credential doesn’t mean every part of the system, including the LLM, needs to see it. Sharing it anyway turns a controlled operation into an avoidable risk.
Related
This entry was posted on August 31, 2026 at 12:15 pm and is filed under Commentary with tags Ridge Security. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Your AI agent has the password. Does the LLM need it?
Here’s a question Ridge Security has been digging into: Can an agent use a secret, like a password or token, without its underlying LLM ever having to see that secret?
Ridge’s answer is yes – but getting there means confronting a real problem with how agents are typically built today.
If a pentest agent’s LLM sees raw secrets, that value doesn’t stay contained to one conversation. It can leak into debug logs, error reports, caches, retries, or saved reports. And once it’s already in the LLM’s context, it’s too late to filter out. It also widens the attack surface, since the value now passes through model infrastructure and becomes a target for prompt injection, where a malicious input could trick the agent into repeating or leaking it.
Ridge’s security team argues the fix isn’t a better filter, it’s a different architecture. They call it a “Security Harness”: the agent gets permission to use a secret without the LLM ever being shown the secret itself. The real credential stays behind a trusted boundary, and the model works with a safe reference it can reason about and use only when an authorized action calls for it. They lay out the thinking, and how it could work, in this recent blog post.
The core idea, as they put it: just because an agent is authorized to use a credential doesn’t mean every part of the system, including the LLM, needs to see it. Sharing it anyway turns a controlled operation into an avoidable risk.
Share this:
Like this:
Related
This entry was posted on August 31, 2026 at 12:15 pm and is filed under Commentary with tags Ridge Security. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.