Credential Proxying for AI Agents

AI agents are now writing code, sending emails, calling APIs, and booking meetings on behalf of users. To do any of this, they need access tokens and secrets. The problem is that agents receive these credentials in their context window, where anything in a GitHub issue or injected prompt can expose them. This is a real attack surface: a bad actor opens an issue asking the agent to log and exfiltrate its token, and the agent complies.

WorkOS just released a product called Relay that addresses this by keeping the credential on the WorkOS side. The agent names the user, and the platform attaches the token for only that request, releases it only to approved hosts, and handles refresh automatically. This is the same pattern the payments industry has used for card data for years, but applied to API credentials.

The market gap is large. Most teams are passing tokens directly into agent context right now and hoping for the best. A focused startup building credential proxying and access governance specifically for AI agent workflows could sell to every company adopting agentic tools. Start by targeting teams using Claude Code or GitHub Copilot in enterprise settings, where security reviews already flag credential handling as a risk.