Give agents credentials they can use but never read: Anthropic's proxy injection pattern

Simon Willison·medium signal

The Claude Code team described their API credential architecture as making secrets 'only usable by the agent but not accessible by the agent' — Claude calls through a proxy that injects credentials on the fly per request, so no token ever enters the context window where injection or exfiltration could reach it. Their auto-approve mode is a separate layer: a Sonnet classifier judges each tool call against the full conversation, which lets it honor dynamic constraints stated mid-prompt like 'don't push.' Before shipping either, they ran thousands of evals plus commissioned external red teamers.