How Secrets Leak Through AI Agents (and How to Stop It) — Venice AI

Hello everyone. Hello everyone. Welcome to my Welcome to my Welcome to my report. I'm Joshua report. I'm Joshua report. I'm Joshua Amato, and today we're Amato, and today we're Amato, and today we're going to talk about some of the going to talk about some of the going to talk about some of the challenges of challenges of challenges of building an AI system building an AI system building an AI system that respects that respects that respects privacy. So, privacy. So, privacy. So, for introductions: for introductions: for introductions: I'm currently the lead I'm currently the lead developer engineer at Venice AI. Currently, I'm working on Currently, I'm working on partnerships, partnerships, partnerships, documentation, documentation, developer communication, a little developer communication, a little engineering, and other engineering, and other engineering, and other things. Before that, I was the things. Before that, I was the things. Before that, I was the lead lead lead maintainer of Rig, the maintainer of Rig, the maintainer of Rig, the leading AI leading AI framework for Rust. framework for Rust. So, what is Venice? Venice is a private and is a private and is a private and unrestricted AI unrestricted AI platform. We platform. We platform. We host all host all host all the latest models with the latest models with the latest models with open source open source open source code. We are 100% code. We are 100% compatible with OpenAI. We do not compatible with OpenAI. We do not compatible with OpenAI. We do not store any store any store any prompts or conversations.

prompts or conversations. We also have a web application through which application through which application through which you can you can you can communicate with communicate with communicate with our models. We our models. We our models. We also have a studio also have a studio also have a studio offering for our offering for our offering for our content creators, which content creators, which content creators, which includes video, audio, includes video, audio, includes video, audio, image generation, image generation, image generation, and transcription. So and transcription. So and transcription. So why is privacy why is privacy why is privacy important? Let's important? Let's important? Let's dig into this. As dig into this. As dig into this. As we know, we know, we know, data leaks are becoming data leaks are becoming data leaks are becoming inevitable, which inevitable, which inevitable, which means means means reputational risks matter reputational risks matter reputational risks matter . It . It only takes one only takes one data leak for data leak for data leak for users to users to users to stop stop stop trusting you and switch trusting you and switch trusting you and switch to another to another to another provider. Or, provider. Or, provider. Or, if you are a if you are a if you are a corporate client corporate client , you may lose , you may lose , you may lose the same client the same client the same client that provided that provided that provided almost 90% of your almost 90% of your almost 90% of your annual revenue. In annual revenue. In annual revenue. In this case, this case, this case, sensitive data sensitive data sensitive data can seriously can seriously can seriously exacerbate the consequences of exacerbate the consequences of exacerbate the consequences of any any any security incident. Additionally, security incident. Additionally, security incident. Additionally, storing less storing less user data user data directly directly directly reduces the impact of a reduces the impact of a security incident. So how does Venice security incident. So how does Venice ensure ensure ensure privacy today privacy today ? There are several ways.

? There are several ways. The first way The first way is that we is that we is that we don't store any don't store any don't store any prompts or conversations, prompts or conversations, prompts or conversations, as we mentioned, as we mentioned, as we mentioned, which means your which means your which means your digital footprint digital footprint digital footprint is reduced to zero. is reduced to zero. So when you So when you use use use models like GLM 5.2 and Kimmy models like GLM 5.2 and Kimmy models like GLM 5.2 and Kimmy 2.7, you can be 2.7, you can be 2.7, you can be sure that none of sure that none of sure that none of your conversations will be your conversations will be your conversations will be stored with us. Everything stored with us. Everything stored with us. Everything will be stored will be stored will be stored locally. We also locally. We also locally. We also have defined levels of have defined levels of have defined levels of privacy. " privacy. " Privacy by Privacy by Privacy by default" default" default" means that means that the above measures are applied. For For providers like OpenAI providers like OpenAI providers like OpenAI and Claude, we and Claude, we and Claude, we anonymize your anonymize your anonymize your user footprint user footprint user footprint so they cannot so they cannot so they cannot identify you identify you identify you from your prompt or from your prompt or from your prompt or queries. We also queries. We also queries. We also host models in host models in host models in trusted trusted trusted execution environments, which means execution environments, which means you can prove you can prove that your inference was that your inference was that your inference was executed in a completely executed in a completely executed in a completely private process.

private process. Additionally, we Additionally, we use a use a software architecture where software architecture where privacy is a privacy is a privacy is a priority. So, priority. So, priority. So, for for for endpoints like endpoints like endpoints like video generation that require video generation that require video generation that require polling servers, we polling servers, we polling servers, we store store store the results in a the results in a the results in a fully fully fully encrypted package encrypted package encrypted package using using using split split split key storage, key storage, key storage, meaning that meaning that meaning that attackers won’t attackers won’t attackers won’t be able to be able to be able to access your data access your data , even if the , even if the , even if the Canva team’s accounts are Canva team’s accounts are Canva team’s accounts are compromised. So I just compromised. So I just compromised. So I just want to introduce you want to introduce you want to introduce you to the idea that not to the idea that not to the idea that not all systems are the same. all systems are the same. So, not all systems are So, not all systems are private. Some private. Some private. Some companies may companies may companies may claim that their claim that their claim that their systems are systems are systems are confidential, but that's confidential, but that's confidential, but that's not entirely true. You not entirely true. You not entirely true. You know how it happens. know how it happens. Although models are a very Although models are a very important part of an important part of an important part of an agent system, agent system, agent system, in fact they are a in fact they are a in fact they are a vital vital vital part, they are only part, they are only part, they are only one component of it. one component of it. In fact, to In fact, to create a complete create a complete create a complete system to system to system to support LLM in support LLM in support LLM in completing a task, completing a task, completing a task, you need to build an you need to build an you need to build an entire process around it entire process around it entire process around it . However, these . However, these . However, these systems are also systems are also systems are also much more much more much more prone to prone to prone to data leaks and data leaks and data leaks and security breaches. So the real security breaches. So the real security breaches. So the real question is, how question is, how question is, how can we optimize the can we optimize the can we optimize the solution to this solution to this solution to this problem? One problem? One problem? One example I would like to example I would like to example I would like to give is give is observability logging.

observability logging. Observability, Observability, Observability, as many of you as many of you as many of you know, is a core know, is a core know, is a core part of any part of any part of any serious production serious production serious production system today. system today. system today. In short, In short, In short, observability observability observability can be divided into can be divided into can be divided into metrics, logs, and metrics, logs, and metrics, logs, and traces. traces. Traceability is Traceability is simply the amount of work simply the amount of work simply the amount of work done per unit of done per unit of done per unit of time. Metrics are time. Metrics are time. Metrics are simply numbers, simply numbers, simply numbers, such as such as such as counters or counters or counters or gauges, while logs gauges, while logs are actual are actual are actual messages. So messages. So messages. So logging, as you logging, as you logging, as you all know, is actually all know, is actually all know, is actually great for great for great for debugging, debugging, debugging, especially in especially in especially in production or production or production or development environments development environments . But you can also . But you can also . But you can also accidentally save accidentally save default hints and secrets default hints and secrets if you if you if you 're not careful, and 're not careful, and 're not careful, and they could contain they could contain they could contain personal personal personal information. However, information. However, information. However, when you when you when you use Venice, use Venice, use Venice, you don't need to you don't need to you don't need to worry about that. worry about that. worry about that. Let's talk Let's talk Let's talk about how secret about how secret about how secret data can be data can be data can be transmitted through a transmitted through a transmitted through a regular agent. regular agent. regular agent. For example, For example, For example, let's say you're let's say you're let's say you're using OpenClaw. using OpenClaw. using OpenClaw. You are sending a You are sending a You are sending a user request. It is user request. It is user request. It is sent to the sent to the agent runtime. The agent runtime. The runtime may runtime may runtime may need a secret, need a secret, need a secret, which it will obtain, which it will obtain, which it will obtain, for example, from a for example, from a for example, from a 1Password or HashiCorp Vault.

1Password or HashiCorp Vault. The secret will then be The secret will then be sent to the sent to the sent to the LLM inference layer LLM inference layer . Oh my God. The inference layer . Oh my God. The inference layer will make an API request will make an API request through a through a through a tool call, which will tool call, which will tool call, which will then return a then return a then return a response response response to the user. However, to the user. However, to the user. However, due to this due to this due to this architecture, secrets architecture, secrets architecture, secrets are passed are passed are passed directly to the LLM, directly to the LLM, directly to the LLM, which means they which means they which means they can be can be can be used in the used in the used in the training data. training data. So, in terms of effective privacy-preserving models, at privacy-preserving models, at Venice we Venice we Venice we use hashes use hashes use hashes for identifiers for identifiers for identifiers instead of direct data. instead of direct data. For example, if you For example, if you need to need to need to identify identify identify a user to a user to a user to limit the frequency of limit the frequency of limit the frequency of requests, it is better not requests, it is better not requests, it is better not to use their to use their to use their direct data. You can, direct data. You can, direct data. You can, for example, store for example, store for example, store them as a hash to them as a hash to them as a hash to identify identify identify a user without a user without directly using their directly using their personal data.

personal data. Additionally, we Additionally, we encrypt data and encrypt data and encrypt data and store it in a store it in a store it in a secure enclave secure enclave secure enclave using using using separate separate separate key storage. For context key storage. For context : encryption keys : encryption keys : encryption keys are stored in two are stored in two are stored in two parts— parts— parts— read and write read and write . This . This . This prevents an attacker from prevents an attacker from prevents an attacker from accessing the accessing the accessing the data, as data, as both both parts are required for decryption. Additionally, parts are required for decryption. Additionally, parts are required for decryption. Additionally, you can you can you can use use use design patterns design patterns such as descriptors that are such as descriptors that are such as descriptors that are easy to recall. easy to recall. easy to recall. So, a handle is So, a handle is So, a handle is simply an object that simply an object that simply an object that gives you access to gives you access to gives you access to something. For example, something. For example, something. For example, suppose you have a suppose you have a suppose you have a database pool that database pool that database pool that uses uses uses a handle. Once a handle. Once a handle. Once you have a handle, you you have a handle, you you have a handle, you can can can access the database pool access the database pool access the database pool . When it is . When it is . When it is not there, access is not there, access is not there, access is impossible. impossible. This is very important, This is very important, especially when especially when especially when using using using authorization, such as authorization, such as authorization, such as JSON web tokens or JSON web tokens or JSON web tokens or session keys, which session keys, which session keys, which can be an important can be an important can be an important part of your part of your part of your authorization system.

authorization system. Also, designing Also, designing prompts with prompts with privacy in mind can privacy in mind can be very useful be very useful be very useful for teams for teams for teams using using using environments like environments like environments like Cursor and Claude Code. Regarding Cursor and Claude Code. Regarding agent descriptor data protection : it is important to ensure a : it is important to ensure a : it is important to ensure a narrow scope of the narrow scope of the narrow scope of the agent to agent to agent to minimize risks. minimize risks. For example, you For example, you get get get tools from the tools from the tools from the MCP server, where there might MCP server, where there might MCP server, where there might be 15 or 20 of them. You be 15 or 20 of them. You be 15 or 20 of them. You don't really don't really don't really need to need to need to use them use them use them all. You all. You all. You only need one, but you also only need one, but you also only need one, but you also need an API key to need an API key to need an API key to make this make this make this call. If you call. If you call. If you take this key from take this key from take this key from your your your password vault and give password vault and give password vault and give it to an agent, it can it to an agent, it can it to an agent, it can be stolen be stolen be stolen when the tool calls the when the tool calls the attacker's third-party web server.

attacker's third-party web server. Additionally, we have a Additionally, we have a Additionally, we have a pre- pre- pre- agent classification layer to agent classification layer to agent classification layer to check for, for example, check for, for example, check for, for example, prompt injection. prompt injection. So, there are several So, there are several ways this can be ways this can be ways this can be implemented. So you implemented. So you implemented. So you can use an can use an can use an LLM-based layer for LLM-based layer for LLM-based layer for this, or this, or this, or alternatively a alternatively a alternatively a semantic search layer, semantic search layer, semantic search layer, for example via for example via for example via vector search vector search vector search using Quadrant, LanceDB, using Quadrant, LanceDB, using Quadrant, LanceDB, or alternatively or alternatively or alternatively use an in- use an in- use an in- memory process. It is also worth memory process. It is also worth memory process. It is also worth noting that narrow noting that narrow noting that narrow context loops context loops context loops caused by a limited caused by a limited caused by a limited scope of an scope of an scope of an agent can also agent can also agent can also improve improve improve the performance of a the performance of a the performance of a context window. context window. context window. So, for example, So, for example, So, for example, because you have fewer because you have fewer because you have fewer tools, your tools, your tools, your agents can agents can agents can perform much perform much perform much better. It is well known better. It is well known better. It is well known that when you fill a that when you fill a that when you fill a context window, context window, performance can performance can degrade significantly as you approach its limits.

degrade significantly as you approach its limits. By keeping the context By keeping the context window empty or window empty or window empty or almost empty, we almost empty, we almost empty, we can ensure the can ensure the can ensure the best performance of the best performance of the best performance of the agent. So, let's agent. So, let's agent. So, let's look at the issue of look at the issue of look at the issue of protecting secrets from protecting secrets from protecting secrets from getting into the model. getting into the model. getting into the model. Here is the Here is the Here is the user request that user request that user request that is sent to the is sent to the is sent to the inference layer inference layer inference layer . This level of . This level of . This level of logical inference logical inference logical inference forms a set of forms a set of forms a set of non-deterministic non-deterministic non-deterministic inputs for the inputs for the inputs for the agentive agentive agentive runtime environment runtime environment . By tying the . By tying the . By tying the password store to the password store to the password store to the agentive agentive agentive runtime runtime rather than the rather than the rather than the inference layer, the inference layer, the inference layer, the runtime runtime runtime effectively effectively effectively becomes an becomes an becomes an execution layer execution layer execution layer that we can that we can that we can consider consider consider deterministic. We deterministic. We deterministic. We can do all the things can do all the things can do all the things that are usually that are usually that are usually impossible to impossible to impossible to implement at the implement at the implement at the LLM level for LLM level for LLM level for privacy and privacy and privacy and security reasons. For example, security reasons. For example, security reasons. For example, let's say you want to let's say you want to let's say you want to use a use a browser tool and you browser tool and you need to log in to a need to log in to a need to log in to a website that requires website that requires website that requires your your your credentials. With such a credentials. With such a credentials. With such a software architecture, it is software architecture, it is software architecture, it is much more reliable much more reliable much more reliable to talk about to talk about to talk about privacy and privacy and privacy and security than to security than to security than to pass the password pass the password pass the password directly to the directly to the directly to the logical logical logical inference level. And also,

inference level. And also, inference level. And also, of course, when calling of course, when calling of course, when calling external APIs. external APIs. external APIs. Regarding agent isolation ( Regarding agent isolation ( sandboxing), sandboxing), sandboxing), it is well known that it is well known that it is well known that using using sandboxes and sandboxes and sandboxes and virtual machines, virtual machines, virtual machines, such as Firecracker or such as Firecracker or such as Firecracker or AWS EC2 in a VPC, can significantly AWS EC2 in a VPC, can significantly AWS EC2 in a VPC, can significantly increase the security increase the security increase the security of your agent. However, of your agent. However, of your agent. However, this is not a panacea for this is not a panacea for this is not a panacea for your agent your agent your agent systems. For example, systems. For example, systems. For example, if your if your if your agent has agent has agent has internet access, internet access, internet access, it can still it can still it can still accidentally transmit accidentally transmit accidentally transmit data through external data through external data through external APIs if you are APIs if you are APIs if you are not careful. Therefore, not careful. Therefore, not careful. Therefore, monitoring monitoring monitoring access rights is critically access rights is critically access rights is critically important. My important. My important. My personal advice is personal advice is to create your own to create your own agentic agentic agentic execution environment. Essentially, execution environment. Essentially, execution environment. Essentially, creating your own creating your own creating your own code frameworks where code frameworks where code frameworks where you can add you can add you can add your own steps, your own steps, your own steps, observability, observability, observability, tools, etc.

tools, etc. In fact, to have a In fact, to have a level of execution and a level of execution and a level of execution and a level of logical level of logical level of logical conclusions. And now, conclusions. And now, conclusions. And now, very briefly, about very briefly, about very briefly, about privacy at the privacy at the privacy at the hardware level. hardware level. So, in this regard, So, in this regard, there is the notion of there is the notion of there is the notion of confidential confidential confidential computing, where a computing, where a computing, where a trusted trusted trusted execution environment actually execution environment actually execution environment actually at the hardware level at the hardware level allows the inference process to be run privately. So here's how it works at Venice privately. So here's how it works at Venice : when you : when you : when you send a request, you send a request, you send a request, you get a response, get a response, get a response, and we also return an and we also return an and we also return an attestation, which you attestation, which you attestation, which you can then can then can then verify verify verify using our using our attestation verifier. So attestation verifier. So this effectively this effectively this effectively means that you can means that you can means that you can completely isolate the completely isolate the completely isolate the agent at the level of agent at the level of agent at the level of logical inference logical inference logical inference cryptographically and cryptographically and cryptographically and prove it. As prove it. As prove it. As for for for confidential confidential tool calls, there tool calls, there is still some work to be done is still some work to be done . TEEs are still great . TEEs are still great . TEEs are still great for for tool calls. However, tool calls. However, we also offer we also offer we also offer end-to-end encryption end-to-end encryption , but there is still work to be , but there is still work to be , but there is still work to be done there due to done there due to done there due to the need to provide a user- the need to provide a user- the need to provide a user- friendly API, friendly API, friendly API, allowing allowing allowing users users users to return fully to return fully to return fully encrypted calls to encrypted calls to encrypted calls to the tools. This the tools. This the tools. This still remains a still remains a still remains a challenge. In challenge. In challenge. In this regard, a very this regard, a very this regard, a very robust solution would be to robust solution would be to robust solution would be to allow allow allow providers to own the providers to own the providers to own the computational computational computational layer on which layer on which layer on which your your your tool call is executed.

tool call is executed. However, oh. So give However, oh. So give me a second. So, me a second. So, me a second. So, regarding the confidential regarding the confidential tool challenges, yes, there tool challenges, yes, there is definitely work to be done here is definitely work to be done here is definitely work to be done here . Yes, that's . Yes, that's . Yes, that's all. Thank you for your attention.