Password vault for AI agents: how they log in safely

AI agents can use your passwords safely only if they never see them: the logins live in an encrypted vault, the agent refers to them by a placeholder such as {{vault:smtp.password}}, and the platform fills in the real value at the moment of use, after you allow it. That keeps credentials out of the chat, out of the AI model's context and out of anything an injected instruction could repeat back. In KutrimBots, the Security Vault works this way for 5 kinds of item, covering API keys, website logins, SMTP email, SSH servers, and bank and card details, and you decide each use with Allow once, Always allow or Deny.

Why shouldn't I paste a password into an AI chat?

Because anything in the chat becomes text the AI reads, keeps in its context and could repeat, including to an attacker who hides instructions in an email or web page.

Security groups say so directly. The OWASP Top 10 for LLM Applications warns that credentials and API keys should not sit in an AI's prompt and should be kept in systems the model can't access. Its entry on prompt injection recommends that the application holds its own API tokens and handles those functions in code "rather than providing them to the model", with a person approving privileged actions.

Stolen and leaked credentials are still one of the main ways in:

A password typed into chat is one more copy you don't control, sitting next to text an attacker may have written.

How can an AI agent use a password it can't see?

The agent writes a placeholder where the secret should go; KutrimBots swaps in the real value on the way out, and masks it on the way back.

Here's what happens when an agent emails an invoice from your Zoho account or calls an API for you:

1. The agent checks the vault list. It sees item names and field names, such as "SMTP Zoho: host, port, username, password", never the values.
2. It writes the request with placeholders, for example an API header Authorization: Bearer {{vault:github.token}}, plus a short purpose you'll read ("List open GitHub issues").
3. You decide. The first time, a card asks: Allow once, Always allow or Deny.
4. KutrimBots fills in the value at the moment of use and sends the request over HTTPS.
5. The result comes back masked. If a response contains the secret, the agent sees [vault:github.token] instead.

That's 1 approval the first time, and 0 after that if you chose Always allow for this item.

Placeholders work only inside the vault's own actions: web requests, sending email through your SMTP login, and the contents of files written to your server over SSH. They don't work in chat messages, notes or code, so an agent can't paste a filled-in password anywhere by mistake. If you deny a use, the agent is told not to look for another way around it.

What can the Security Vault store, and what can agents do with it?

API tokens, website logins, SMTP details, SSH servers, bank details and cards, each with a clear limit on what an agent may do.

Two more rules: the vault can't be shared, and an item's allowed hosts limit where its values can be sent. On a server, commands that delete folders, reboot, change users or passwords, touch the firewall or stop SSH always need their own approval.

Security Vault rules at a glance

As of November 2026:

How do I give an agent a secret without typing it in chat?

The agent asks for it with a secure card; you type the value into a form that goes straight to the vault.

1. Ask for the job, not the password. "Send this month's invoices from accounts@mybusiness.in."
2. The agent checks the vault. If the SMTP login isn't there, it opens a request for it with a title such as "SMTP Zoho" and the fields it needs.
3. A secure form opens for you, asking for exactly the fields the agent named, such as host, port, username and password.
4. You fill it in and save. The value goes into the encrypted vault, not into the chat.
5. The agent gets a message that it's saved, and carries on using the placeholder.

If you start pasting a password into chat, a KutrimBots agent is instructed to stop you and open the secure form instead.

Should I use a vault or an app connection?

Use an app connection (OAuth) wherever one exists, and the vault for everything that only works with a password, key or server login.

With app connections, you connect Gmail, Outlook, Slack, Notion, HubSpot, Shopify and the rest of 500+ connectors (1,500+ apps) by signing in on the app's own page; KutrimBots never sees that password, and every agent can use the connection with approval before anything that sends, changes or deletes.

When an agent needs its own account for a tool, a test or a trial, it signs up with its own Email Inbox address, not yours, and the vault makes a strong password. It reads the verification code itself, never pays or adds a card, and tells you which accounts it made.

Example scenario: a 4-person web agency in Indore

The numbers are assumptions for illustration, not customer data.

The agency stores 6 items in the Security Vault: an SMTP login for invoices, a GitHub token, the SSH login for its VPS, two client CMS logins and the company card for the owner's reference. Its agents:

1. Email 22 invoices a month from the agency's Zoho Mail address; the owner chose Always allow for the SMTP login after the first week, and each invoice email still asks before it goes out.
2. Read open GitHub issues every morning for the daily brief, with Always allow for that token.
3. Deploy client sites to the VPS about 8 times a month; routine commands run, while 2 or 3 risky commands a month, such as removing an old release folder, ask every time.
4. Sign in to client CMS dashboards about 10 times a month, with 1 approval per sign-in.

That's about 35 approvals a month, fewer than 2 a working day. Nobody pasted a password into chat, and no agent ever saw the card.

What should I never give an AI agent?

Anything that moves money by itself or proves your identity: card PINs and CVVs, UPI PINs, net banking passwords and banking OTPs.

1. Card numbers, CVVs and PINs. In KutrimBots the vault keeps them for you, and agents can't use them.
2. UPI PINs and banking OTPs. A one-time code for a website sign-in is one thing; a code that approves a payment is another. Keep payments in your own hands.
3. Your main email password. Connect your mailbox with its own sign-in, or give the agent its own address.
4. Recovery codes and master passwords for your password manager.
5. Admin logins you don't need to share. Create a limited user for the agent where the app allows it.

What can't a vault protect you from?

A vault stops agents from seeing secrets; it doesn't stop an agent from misusing the access you allow.

1. Broad "Always allow". Allowing an API key for every purpose lets any mistake use it. Keep Always for narrow, repeated jobs.
2. Prompt injection. A malicious email can still try to trick an agent into using a login wrongly. Approvals on sending, paying and deleting are your second line; see are AI agents safe? for the wider checklist.
3. Weak passwords elsewhere. If the site itself is breached, the vault can't help; use unique passwords and two-factor sign-in.
4. What you approve. A purpose line like "List open GitHub issues" is only useful if you read it.

To see how secrets fit with tools, memory and approvals, read how AI agents work. You can try the Security Vault on the free 7-day trial; nothing is charged on day one.

Frequently asked questions

Is there a password manager for AI agents?

Yes. Agent platforms are adding vaults built for agents rather than people. In KutrimBots, the Security Vault stores 5 kinds of item (logins, API keys, cards, notes and SSH servers, including SMTP and bank details) encrypted, and agents use them through placeholders without ever seeing the values.

How can an AI use my password without seeing it?

The agent writes a placeholder such as {{vault:smtp.password}}, and KutrimBots fills in the real value at the moment of use, after you allow it, in 1 of 3 places: a web request, an SMTP email or a file written over SSH. Results containing the secret come back masked.

What do Allow once, Always allow and Deny mean for vault items?

Allow once approves this single use; Always allow approves this item for that kind of use from now on; Deny blocks it, and the agent tells you what it couldn't do. For website sign-ins, "for this sign-in" covers that site for 15 minutes.

Can an AI agent use my credit card?

Not in KutrimBots. Card numbers, CVVs and PINs in the vault are for you only, and agents never pay or add a card when signing up for anything.

Should I give an AI agent my Gmail password?

No. Connect Gmail with Google's own sign-in, so KutrimBots never sees the password, or give the agent its own email address with Email Inbox.

Sources

• LLM07:2025 System Prompt Leakage (OWASP)
• LLM01:2025 Prompt Injection (OWASP)
• 2026 DBIR: exploitation overtakes stolen credentials as the top entry point (Verizon)
• 2026 Data Breach Investigations Report (Verizon)
• AI is fueling secrets sprawl: GitGuardian reports an 81% surge of AI-service leaks (CIO Dive press release)