Someone lost 0.493 ETH because an old stolen private key was never rotated. The attacker waited, then drained it once funds arrived. AI agents face the same risk. If the key lives in the process, it…

Obot, an AI agent platform, just patched an SSRF: attackers supplied a URL the server fetched internally, reaching cloud metadata to steal credentials. Keep agent secrets in a vault, not the process,…

An OAuth bug lets attackers take over accounts by linking their Google login to an unverified email. Once in, every API key there is theirs. Keys in a vault with policy gates can't be stolen this…

Pequod botnet: open dir on a VPS, SSH keys and a Telegram bot token just sitting there. An agent's signing key should never live in the agent process. Vault-side, policy-gated: a compromised host has…

An agent holding your full platform credentials is a liability. If compromised, an attacker gets Meta-level control of your account with zero recourse. @elizaOS and @langchain builders: keys stay in…

The whole thesis in one post: AI agents should never hold the keys. Identity, scoped intent, instant revocation, full audit. If you build on @elizaOS or @base, this is the ten-minute read:

Jaredfromsubway.eth just lost $7.5M. A bot that signs transactions holds a private key in its process. That key is the attack surface. If the signing key never lives in the agent, there is nothing to…