The agent never sees the API key

Box OpenCode in Kata containers and inject API keys at the proxy. Security-minded developer.

Share on 𝕏 ↗ Compare with… Read the source ↗

what to steal

Inject credentials at an egress proxy so a compromised agent can't leak them.

Our takeaway from the source, not a quote.

Drawn from this card's sourced fields. Amber = older model named by the source. Rose = cut or replaced.

codefault-opencode-kata-egress.toml

# Box OpenCode in Kata containers and inject API keys at the proxy
# source: https://x.com/Code_Fault/status/2110221511063679359

[rig]
who     = "Security-minded developer"
author  = "Caleb Burns (@Code_Fault)"
date    = "2026-10-14"

harness = ["OpenCode"]
models  = []

[keep]
  - OpenCode inside a Docker container on the Kata runtime
  - Egress restricted with iron-proxy
  - iron-proxy MitM-injects API credentials
[cut]
  - Keys in the agent environment

thing	status	why (per source)
Keys in the agent environment	removed	Credentials are injected at the proxy

Source: https://x.com/Code_Fault/status/2110221511063679359 · checked 2026-10-14

Laptop as control room, home PC as the engine

steal → Run agents on an always-on box behind one model gateway; reach it with zero open ports.

Claude CodeCodexPi Any model behind 9Rout

by Nadim Tuhin

~/rigs/elilap-openclaw-hermes-proxm….toml2026-06-05

OpenClaw and Hermes in separate VMs, so neither is a single point of failure

steal → Put each agent in its own snapshot-able VM; fix credentials next.

OpenClawHermes AgentCodex GPT-5.5Qwen3.6 27B / 35B Credentials in the age

by Eli Lap

~/rigs/stefancrncic-t3-three-machin….toml𝕏 · 2026-10-13

Five harnesses, three machines, one orchestrator

steal → Install several harnesses on worker machines and drive them from one place.

Claude CodeCodexCursor

by Stefan (@stefancrncic)