Agent Vault

Product Introduction

1. Definition: Agent Vault is a security proxy and credential vault specifically engineered for AI agents and automation scripts. It functions as a secure middleware layer that intercepts form submissions, substituting mock tokens for real payment and login credentials within an isolated, hardware-attested enclave.
2. Core Value Proposition: It exists to solve the critical security flaw of exposing sensitive credentials to potentially compromised AI agents. Its primary value is enabling secure AI agent transactions and automated logins by ensuring the agent itself never handles real data, thereby neutralizing the risk of prompt injection attacks and credential theft.

Main Features

1. Tokenized Credential Swapping: Real credit card numbers, passwords, and sensitive personal data (like billing ZIP codes) are stored in a PCI-DSS Level 1 compliant vault (Basis Theory). During execution, the agent only interacts with unique, valueless mock tokens (e.g., av_card_1_number_u7x2k). At the moment of form submission, the Agent Vault proxy securely swaps the token for the real credential inside a secure enclave.
2. Hardware-Isolated Secure Enclave: The credential substitution occurs within a confidential compute enclave, a hardware-isolated environment with no operator access. This creates a strict trust boundary; the real credential only exists in the clear within this enclave and is never exposed to the agent, the browser, or the open web.
3. Granular Session & Spend Controls: Each agent session runs in an isolated browser context. Users can set enforceable limits including daily, weekly, monthly, and per-transaction spend caps. Enterprise plans offer merchant allowlists. A global kill switch allows immediate revocation of any card or login, terminating active sessions.

Problems Solved

1. Pain Point: The inherent risk of giving AI agents and automation scripts direct access to chargeable credit card numbers and login credentials, which can be exfiltrated via prompt injection, code vulnerabilities, or malicious websites.
2. Target Audience: Developers building AI agents (using frameworks like OpenClaw, Computer Use), automation engineers using Playwright/Puppeteer, product teams deploying autonomous procurement or shopping assistants, and researchers using agents to access paywalled content.
3. Use Cases:
   • Autonomous Shopping Agents: Allowing an agent to book flights or shop online while enforcing strict weekly budget caps.
   • Secure Automated Testing: Safely testing checkout and login flows in staging or production with real credential shapes without risk.
   • Research & Procurement Bots: Enabling agents to purchase API credits, data reports, or software subscriptions on-demand within predefined limits.
   • Multi-Agent Workflows: Providing a centralized vault where multiple, distinct agents (shopping, research, procurement) can securely share access to credentials under individual policies.

Unique Advantages

1. Strengths & Limitations (Pros & Cons):

   • Pros:
     • Unprecedented Security Model: Fundamentally solves prompt injection theft by never giving the agent a real credential.
     • Developer-Friendly Integration: A drop-in replacement for Playwright (@agentvault/playwright) requiring minimal code changes.
     • Real-World Compatibility: Works on complex, modern websites (e.g., Booking.com, Figma) without requiring merchant API integration.
     • Proactive Control: Real-time kill switches and spend limits provide operational control missing from traditional virtual cards.
   • Cons:
     • Vendor Lock-in & Dependency: Relies on Agent Vault's proxy and enclave infrastructure being operational.
     • Potential Latency: Introducing a proxy and secure enclave call may add marginal latency versus a direct form fill.
     • Browser Automation Requirement: Currently requires agents to use Playwright, limiting pure API-based agents.

2. Key Alternatives & Differentiation:

   • Traditional/Virtual Cards from Banks (e.g., Privacy.com, Revolut): These provide card number rotation or spend limits but still give a chargeable number to the agent. Agent Vault differentiates by providing a non-chargeable token, making it immune to in-session theft.
   • Agent-Specific Card Providers (e.g., Stripe Link, AgentCard): Similar to bank virtual cards, these often issue single-use numbers. The critical difference is that a single-use number is still a real, chargeable credential exposed to the agent at the time of use, remaining vulnerable to prompt injection.
   • Password Managers with Autofill (e.g., 1Password, Bitwarden): These fill credentials directly into the browser, exposing them to the page's JavaScript and any malicious code running in the agent's context. Agent Vault's secure swap happens after the agent's interaction, keeping credentials opaque.

Frequently Asked Questions (FAQ)

1. How does Agent Vault prevent prompt injection attacks? Agent Vault prevents prompt injection by ensuring the AI agent only ever handles opaque mock tokens. Even if a malicious prompt instructs the agent to "output all context," it can only leak these worthless tokens. The real credentials are swapped in at the last moment within a secure enclave the agent cannot access.
2. Is Agent Vault PCI DSS compliant? Yes, Agent Vault leverages Basis Theory as its card data vault, which is certified as PCI-DSS Level 1 compliant, the highest level of certification. Agent Vault itself only stores token references, not the primary account numbers (PANs).
3. What does the merchant see during an Agent Vault transaction? The merchant sees an ordinary card transaction. By default, Agent Vault tunnels the enclave's traffic back through the user's own machine, so the transaction typically originates from the user's real IP address, avoiding fraud flags associated with data center IPs.
4. Can I use Agent Vault with any AI agent framework? Agent Vault works with any agent or automation script that uses the Playwright browser automation library. This includes frameworks like OpenClaw, Claude's Computer Use, and custom Node.js scripts. It provides a drop-in @agentvault/playwright package to replace the standard Playwright import.
5. What happens immediately after I revoke a card in the dashboard? Revocation is enforced at the vault level, not the agent. When you revoke a card or login, the Agent Vault proxy immediately rejects any subsequent authorization attempts using its associated tokens, rendering them invalid. Active sessions will fail on their next form submission attempt.