Infisical’s $16M Series A Fuels Agent Proxy Launch to Block AI Agent Credential Leaks

Infisical Shipped Agent Proxy, an Open-Source Component That Lets AI Agents Call External APIs Without Ever Seeing Real Credentials

Infisical launched Agent Proxy, an open-source component that lets AI agents call external APIs without ever seeing the real credentials. The agent receives a placeholder token; the proxy swaps it for the actual secret at the moment of the outbound call, then scrubs the response on return. The secret lives only in the proxy's memory for a single hop. That architectural shift — never letting the agent hold the key — is the company's answer to a problem that has moved from theoretical to operational: prompt injection can exfiltrate credentials from agent memory.

The launch marks a new battleground for open-source security in enterprise AI workflows. HashiCorp Vault and Doppler, two established secrets-management platforms, are accelerating their own agent-focused capabilities. Infisical's bet is that the only sustainable fix is structural: move the trust boundary from the agent process to a controlled gateway the security team owns and audits.

The Credential Gap and the Proxy Architecture

AI agents need credentials to call payment APIs, query customer databases, and trigger deployment workflows. Handing those credentials to the agent creates a surface that prompt injection can exploit: one malicious instruction and the model prints the keys it holds. Legacy secrets managers store and rotate secrets well, but they were built for services and humans, not for autonomous agents that reason, plan, and act in loops. The gap is not storage; it is exposure during execution.

Infisical's Agent Proxy inserts a broker between the agent and the outside world. Each agent runs in an ephemeral sandbox the proxy spins up per session. Scoped access rules define exactly which tools and APIs a given agent may reach; everything else is blocked at the proxy layer. Every request (headers, payload, destination, timestamp) is logged, producing an audit trail security teams can query without instrumenting the agent code. The design goal is not just secrecy but observability without instrumentation.

This differs from the pattern most teams improvise today: baking secrets into environment variables at container start, or embedding them in prompt context. Both leak under prompt injection. HashiCorp Vault and AWS Secrets Manager solve the at-rest and in-transit problems for services, but they do not mediate the runtime exchange between an agent and an external API. The proxy model shifts that boundary to a gateway the security team controls.

Infisical built this on its existing open-source platform (28.6k GitHub stars, 2.2k forks, and 26,603 commits), which already handles secrets, certificates, and privileged access for infrastructure. Infisical reports securing ten billion secrets daily across its install base, a figure that reflects the scale of its core platform before the agent features shipped.

Traction Meets Compliance

A March 2024 Reddit thread in r/devops put it bluntly: "Infisical is being used in production by Fortune 500 enterprises, international governments, and fastest-growing startups." The claim matches the trajectory visible in the project's GitHub metrics and the compliance stack that makes procurement possible. Infisical lists SOC 2 Type II, HIPAA, and FIPS 140-3 validation — the gatekeeper for U.S. federal workloads — plus 99.99% availability SLAs, continuous penetration testing, and self-hosted deployment as a first-class option. That combination is the requirement for air-gapped environments and data-sovereignty mandates in Europe and the public sector.

Testimonials on the company's site read like production post-mortems, not marketing copy. One engineer wrote: "I deleted all our .env files from our disc and moved everything to Infisical. Wish I did it sooner. Now: secrets never touch disk, secrets auto-shared between developers, edit in one place, propagate to prod, GitHub actions, staging env etc." Another cited the Vercel breach as the catalyst: "Especially after the Vercel incident, I moved all my credentials over to Infisical." These describe specific migration paths from scattered .env files and cloud-provider lock-in to a centralized, auditable workflow.

The customer page lists Hugging Face, Writer, Lucid, OpenRouter, and Excalidraw. Rocky Olsen, Principal SRE Engineer at Lucid, said: "What impressed us most was they were responding to bug reports and implementing requests during the pre-sales cycle." The combination of FIPS 140-3, self-hosted deployment, SLAs, and a London enterprise hire forms a coherent pattern: Infisical has crossed the chasm from open-source popularity to procurement-ready infrastructure.

Hiring Signals EMEA and Federal Push

Infisical's job board shows two roles added in the past seven days, with six open roles currently listed. The engineering slate includes a Senior Full Stack Engineer in San Francisco ($180k–$250k, Zero G Talent's job board reports), two Design Engineer tracks (brand and product, $100k–$180k each), and a broadly remote Full Stack role spanning the Americas with explicit welcome for candidates from Brazil, Argentina, and Colombia.

The London role signals EMEA intent: an Enterprise Account Executive tasked with regulated accounts across Europe. The Solutions Engineer slot explicitly lists Washington, DC, among its locations, mirroring a federal playbook: proximity to agencies that require FIPS 140-3, HIPAA, and SOC 2 compliance before they'll run a proof of concept.

Engineering hiring reflects the product depth those buyers demand. The Senior Full Stack role sits at the top of the band. The two Design Engineer openings indicate investment in the developer experience. The board's "We are growing fast and would love for you to join us" banner appears on the public repository, signaling that runway is being spent on people who can turn community trust into contracted revenue across regulated verticals.

Incumbents Pivot to Agent-Centric Security

HashiCorp's $6.4 billion acquisition by IBM closed on February 27, 2025, giving the combined entity a direct channel into regulated enterprises that now demand identity-based security for autonomous workloads. IBM's HashiCorp page frames the portfolio around "security lifecycle management" built on a zero-trust foundation, with Vault providing "machine identity management by encrypting sensitive data and gating access based on identity." That language — machine identity, identity-gated access — is the same vocabulary Infisical uses for its Agent Proxy.

Vault's new HCP Vault Radar, launched under IBM stewardship, scans repositories and CI/CD pipelines for "hardcoded passwords, API keys and tokens" and prioritizes remediation. The feature addresses the exact exposure vector that Infisical's Agent Proxy eliminates: long-lived credentials checked into code or passed to agents at runtime. HashiCorp's Boundary and Consul extend the same identity-driven model to remote access and service networking, creating a suite that can issue short-lived, policy-bound credentials to any workload (human or synthetic).

Doppler has rewritten its homepage to lead with "Secrets management for humans and AI agents." The platform's AI-agent positioning appeared in step with broader market demand. Neither company has publicly framed these moves as a reaction to Infisical. HashiCorp's roadmap has emphasized machine identity for years, and Doppler's shift coincided with the explosion of LLM-driven automation.

The convergence is unmistakable: the two most established secrets-management platforms now treat agent credentialing as a core use case, not an edge case. HashiCorp's IBM-backed sales force can bundle Vault Radar with hybrid-cloud deals; Doppler's developer-first distribution mirrors Infisical's open-source flywheel.

The Proxy Becomes the Perimeter

Infisical's Agent Proxy, HashiCorp's identity-gated Vault, and Doppler's short-lived token injection all converge on the same principle: the agent must never hold the secret. Infisical's placeholder token, swapping in the real key for a single hop and vanishing, is a clean demonstration of that principle shipped as open source.

Working in frontier tech? Zero G Talent tracks the openings: see every open Infisical role, browse frontier tech jobs, the companies hiring, and the people building the field.