---
title: "The agent never holds the key"
date: 2026-10-29
series: 28
summary: "The platform vendors just agreed on one thing: an AI agent should never hold a real credential. If your agents read API keys from env vars, that is now the design to migrate off."
voice: architect
tags: [agent-sandbox-runtime, credential-injection-egress, attested-agent-identity, sandbox-fail-open-default, agent-runtime-standardization]
image: "/notes/agent-sandbox-runtimes/image.png"
imageAlt: null
linkedin: "urn:li:share:7521436913782861824"
sources:
  - title: "NVIDIA OpenShell v0.1.5 release notes (2026-10-20)"
    url: https://github.com/NVIDIA/OpenShell/releases/tag/v0.1.5
    date: 2026-10-20
  - title: "Google Cloud blog, Agent Compute Engine announcement (2026-10-22)"
    url: https://cloud.google.com/blog/topics/ai-infrastructure/introducing-agent-compute-engine-and-expanded-agent-governance
    date: 2026-10-22
  - title: "Google Cloud blog, ACE deep dive, credential model (2026-10-23)"
    url: https://cloud.google.com/blog/topics/ai-infrastructure/agent-compute-engine-deep-dive
    date: 2026-10-23
  - title: "Linux Foundation press, AAIF takes in OpenSandbox, Agent Skills, Open Responses, OpenEnv (2026-10-22)"
    url: https://www.linuxfoundation.org/press/agentic-ai-foundation-announces-four-new-projects-agent-skills-open-responses-openenv-and-opensandbox
    date: 2026-10-22
  - title: "Context, same pattern at AWS: Strands Box, egress gateway swaps placeholder tokens (2026-10-07)"
    url: https://aws.amazon.com/blogs/opensource/introducing-strands-box-ai-agent-sandboxes-powered-by-dogwood/
    date: 2026-10-07
  - title: "OpenSandbox (Firecracker 64 ms P50 creation)"
    url: https://github.com/opensandbox-group/OpenSandbox
dateApprox: false
---

The platform vendors just agreed on one thing: an AI agent should never hold a real credential. If your agents read API keys from env vars, that is now the design to migrate off.

This matters if you run agent fleets in containers you sandbox yourself, on-prem included. In one week the runtime layer became a product category: NVIDIA shipped OpenShell v0.1.5 (Oct 20), Google announced Agent Compute Engine with Substrate benchmark numbers (Oct 22), and the Linux Foundation's Agentic AI Foundation took in OpenSandbox from Alibaba plus projects from Anthropic, OpenAI and Hugging Face.

Google's published benchmark: 200,000 agents, a sustained 500 activations per second, suspend and resume under 500 ms, and a vendor-stated 10x compute density over standard runtimes.

The design the big runtimes converge on: the sandbox never sees a secret. The agent gets a short-lived attested identity (SPIFFE). An egress gateway validates the delegation, then injects the real credential into approved requests only. Compromise the agent and you hold nothing durable.

The decision: stop evaluating sandboxes by isolation tech alone. Pick the credential-injection pattern first, microVM vs kernel controls second.

The trap: until the Oct 20 release, one of these runtimes' network brokers fell back to native handling when it could not verify a descriptor. Fail-open, in the component that is the whole point.

List every place an agent of yours can read a long-lived credential. That list is your migration backlog.