Obfuscating and mediating sensitive credentials for generative agent environments

Abstract

This disclosure describes systems and methods for securely mediating access by generative artificial intelligence (AI) agent to external services without exposing sensitive credentials to the generative AI agent. The disclosed systems can store sensitive credentials within a secret store inaccessible to the generative model agent, generate opaque placeholder credentials bound to designated domains and request constraints, and inject the opaque placeholder credentials into the generative agent environment. The disclosed systems can intercept requests from the generative agent environment containing the opaque placeholder credentials, verify that the requests satisfy domain and request constraints, and replace the opaque placeholder credentials with cryptographic credentials derived from the sensitive credentials. The disclosed systems can provide the regenerated requests to external services and return outputs from the external services to the generative agent environment.