I run AI agents all day, every day. They read my email, they push code to GitHub, they post to Telegram, they keep my sites running while I sleep. And every one of those agents needs keys to do it. Real keys, to my real accounts. So the question I could never let go of was simple: where do those keys actually live?

Full disclosure before we go any further: Agent Master Key is my product. I built it, my company ships it, and this is my site. You should know that going in, and you should read this with that in mind. What I can do is show you the evidence that made me build it, because none of it is mine.

The cloud keeps proving my point

I did tech support at Apple for 7 years, and the pattern I saw there is the same pattern I see in every breach report now: people put everything in one place because it is convenient, and then that one place becomes the thing worth attacking.

Look at the run we have been on. In 2022, attackers walked out of LastPass with encrypted copies of customer password vaults, and investigators were still tying crypto thefts back to those vaults three years later. In January 2023, CircleCI told every single customer to rotate every secret they had ever stored after one engineer's laptop got infected. Later that year, Okta's support system leaked live admin session tokens that attackers used against Cloudflare and 1Password. In 2024, credentials stolen off personal machines were used to raid about 165 Snowflake customer accounts, including the Ticketmaster haul. In 2025, OAuth tokens taken from one chat-bot vendor, Salesloft Drift, opened the door to Salesforce data at more than 700 companies.

And then this May it reached the AI agent world directly. Composio, a hosted integration platform that holds credentials so agents can use them, disclosed a breach that started with one employee's Gmail OAuth token and ended with around 10,200 customer credentials exfiltrated, including 5,001 GitHub OAuth tokens. I wrote up the full chain of events in my Composio breach breakdown if you want the details. To their credit, Composio disclosed fast and told the truth. That is more than a lot of companies do.

Six different companies. Four years. Same story every time.

The math is not complicated

Put yourself in the attacker's seat for a second. Option one: break into one person's Mac and maybe get one person's keys. Option two: break into a provider that holds credentials for thousands or millions of people, and get everyone's keys at once. Which job would you take?

That is the whole argument. Centralized credential storage creates a prize worth a professional attack. Every key added to a cloud vault makes that vault more worth breaking into, and none of those keys are yours to protect. You are trusting someone else's employee not to click the wrong link. In the Composio case, one Gmail token was the entire perimeter.

A local vault flips the economics. My keys sit on my Mac. If an attacker wants them, they have to come to my machine specifically, for a payoff of exactly one person's credentials. Nobody is spending months of effort on that. It is not that my Mac is a fortress and a data center is not. It is that my Mac is not a target worth the trouble, and a pile of a million tokens is.

What Agent Master Key actually does

Agent Master Key is a Mac app. Your credentials go in a vault that lives on your machine, encrypted, and they do not leave it. When an AI agent needs to do something, it does not get your keys. It talks to a local broker, the broker checks what that agent is allowed to touch, and you approve the connection. The agent gets scoped access to do the job. Your GitHub token never gets pasted into some config file, never gets uploaded to someone's platform, never sits in a cache waiting for someone else's bad day.

It works with the agent stacks people actually run, over MCP, and it ships with GitHub and Telegram connectors today. If you have ever wondered what a credential broker even is, I wrote a plain-English explainer here, and if you want the broader hygiene picture there is my guide to protecting API keys in 2026.

What I am not telling you

I want to be straight about the tradeoffs, because a local vault is not magic and I do not sell magic.

If your Mac dies and you have no backup, that is on you. Local-first means you own custody, and owning custody means owning the boring parts too. If you are a 50-person team that needs central management, audit trails across the org, and shared secrets, a managed cloud secrets service is honestly the more practical call, and I say exactly that in my local-first versus cloud credential storage comparison. And no vault, local or cloud, saves you from granting an agent more access than it should have. You still have to audit what your agents can touch.

But if you are one person, or a small shop, running agents on your own hardware with your own accounts, I think the answer is clear. The keys should stay home.

Where this goes

I keep agents running around the clock on my own machines, and I built the thing I needed to do that without leaking keys. Right now Agent Master Key is free for a limited time, no card, while we are in the launch window, so you can download it and see if it fits how you work.

I am not going to tell you the cloud is doomed. I am telling you what the last four years of breach reports told me: the biggest pile of keys gets attacked, and the surest way to keep your keys out of the pile is to never put them in one. If this saves you from even one leaked token, that is all gravy.