Coder

Two security incidents from October 21 made me rethink how we run AI agents. First, LiteLLM, a Python library many AI teams use to call LLMs, was hit by a supply chain attack. Version 1.107.0 on PyPI and Docker shipped malware that steals environment variables, cloud credentials, private keys, and the credential files of AI dev tools. Second, Railway (a cloud provider) disclosed that someone may have accessed the systems that store customer environment variables, and for some users, the decrypted values too. Railway asked everyone to rotate their API keys and database passwords and to check for unexpected usage on OpenAI, Anthropic, and OpenRouter. They believe it’s part of a wider campaign to steal access to AI inference providers. Both incidents point at the same target: the secrets sitting in env variables and your LLM API keys, most of all. Now think about AI agents. In a lot of agent setups, the model key sits in the same environment where the agent runs code. So where do your agents run, and where do their keys live? I’ve been using Coder Agents, and here is how its design handles both problems: The agent loop runs in the Coder agents control plane, not inside the workspace. When a task needs a machine, Coder Agents creates a workspace and then reads, writes, and runs commands in it. LLM API keys managed by Coder agents stay in the control plane, separate from the workspace where the agent executes commands. The workspace doesn't need an AI agent harness or direct access to those provider credentials. So if a malicious package runs inside the workspace, it can't simply read Coder's provider key from the workspace environment, though other secrets and resources in that workspace could still be exposed. Admins set models, system prompts, and tool permissions on the server. Developers can’t override these from the chat. Every agent action is tied to the person who sent the prompt. There’s no shared bot account, and the agent gets the same access as that user, nothing more. To be fair, this doesn’t fix supply chain attacks. Other secrets inside a workspace still need care. Also, by default an agent workspace gets the same network access as any other workspace, so the docs recommend separate agent templates with stricter outbound rules. Coder Agents allow for a clearer distinction between credential isolation and broader security guarantees. This separation also allows tighter network restrictions on agent workspaces without disrupting LLM access and reduces the blast radius of a compromised workspace by keeping LLM credentials separate. If you want to try it, here’s the quick setup from the docs: > Install Coder agents and start the server > Create a template with a clear name and description. > The agent reads it to decide where to work. > Go to Admin settings > AI > Providers and add your LLM provider key (Anthropic, OpenAI, Google, Bedrock, Azure, and others). This key lives only in the control plane. > Go to Admin settings > AI > Models and click Add model. > Open the Agents page, pick your model, and type your first task. (This post is sponsored by Coder.) Learn more here: fandf.co/3PTG8l2 After this week’s news, would you still keep LLM keys inside the place where your agents run code? #AIAgents #CyberSecurity #DevOps #PlatformEngineering #Coder