Analysis · curated 2 Sep 2026
Keeping credentials out of an AI agent's context with Relay
First reported workos.com
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
Prompt-injection defenses that keep secrets out of the agent's context reduce what an attacker can exfiltrate even after a successful injection, a concern for anyone deploying agents that read untrusted web pages, tickets, or inboxes.
WorkOS describes Relay, an early-access product that proxies an AI agent's third-party API calls and injects the credential at the boundary, so a prompt-injected agent holds no token to steal and has nowhere to exfiltrate it. The write-up explains the design pattern (credential brokering, allowlisting outbound destinations, and shifting the attack surface to the broker) and grounds it in research on design patterns for securing LLM agents against prompt injection.