The agent never holds the key

The platform vendors just agreed on one thing: an AI agent should never hold a real credential. If your agents read API keys from env vars, that is now the design to migrate off.

This matters if you run agent fleets in containers you sandbox yourself, on-prem included. In one week the runtime layer became a product category: NVIDIA shipped OpenShell v0.1.5 (Oct 20), Google announced Agent Compute Engine with Substrate benchmark numbers (Oct 22), and the Linux Foundation's Agentic AI Foundation took in OpenSandbox from Alibaba plus projects from Anthropic, OpenAI and Hugging Face.

Google's published benchmark: 200,000 agents, a sustained 500 activations per second, suspend and resume under 500 ms, and a vendor-stated 10x compute density over standard runtimes.

The design the big runtimes converge on: the sandbox never sees a secret. The agent gets a short-lived attested identity (SPIFFE). An egress gateway validates the delegation, then injects the real credential into approved requests only. Compromise the agent and you hold nothing durable.

The decision: stop evaluating sandboxes by isolation tech alone. Pick the credential-injection pattern first, microVM vs kernel controls second.

The trap: until the Oct 20 release, one of these runtimes' network brokers fell back to native handling when it could not verify a descriptor. Fail-open, in the component that is the whole point.

List every place an agent of yours can read a long-lived credential. That list is your migration backlog.