alt Hacker NewsOneCLI assumes that the proxy is fully trusted by the agent and it still has authorized access to your accounts.
What happens when the agent environment is breached? All you need is the fake key + URL of the proxy and that maps to your real keys and you can make authorized requests outside of the agent.
The real keys don't have to be leaked, just the fake ones have to map to the real one; so unless they are rotated, then this is a problem.
Exactly. I appreciate the considerations they have already taken, this is definitely a problem that needs to be addressed as agentic AI continues its warpath.
However, this feels to me like widening the attack surface rather than tightening security. I'm going to dig in to this over the next few weeks. Hopefully I prove myself wrong