用受控能力替代直接暴露密钥，提升智能体安全执行
CapSeal: Capability-Sealed Secret Mediation for Secure Agent Execution
- 通过本地可信代理限制密钥使用范围，仅允许特定操作
- 实现防重放、可审计的密钥调用机制，杜绝秘密泄露
- 适合需要高安全性部署的AI Agent开发者与系统架构师
现代AI智能体频繁依赖API密钥、SSH凭证等敏感信息，但主流部署方式仍通过环境变量、本地文件或转发套接字直接暴露给智能体进程。该设计在面对提示注入、工具滥用和模型控制的数据外泄时存在严重缺陷，因为智能体既能使用又能泄露同一凭证。本文提出CapSeal——一种能力封印式密钥管理架构，将直接密钥访问替换为通过本地可信代理进行受控调用。CapSeal结合能力发放、结构化约束的HTTP执行、代理执行的SSH操作、防重放会话绑定、策略评估及不可篡改的审计日志。我们构建了基于Rust的原型，并集成至MCP适配器；定义了非披露、受限使用、抗重放与可审计性等条件性安全目标，制定了涵盖提示注入、工具滥用和SSH滥用的评估方案。最终系统将密钥管理从‘交付密钥’转变为‘授予有限、不可导出的操作能力’。
原文摘要 · Abstract (English)
Modern AI agents routinely depend on secrets such as API keys and SSH credentials, yet the dominant deployment model still exposes those secrets directly to the agent process through environment variables, local files, or forwarding sockets. This design fails against prompt injection, tool misuse, and model-controlled exfiltration because the agent can both use and reveal the same bearer credential. We present CapSeal, a capability-sealed secret mediation architecture that replaces direct secret access with constrained invocations through a local trusted broker. CapSeal combines capability issuance, schema-constrained HTTP execution, broker-executed SSH actions, anti-replay session binding, policy evaluation, and tamper-evident audit trails. We describe a Rust prototype integrated with an MCP-facing adapter, formulate conditional security goals for non-disclosure, constrained use, replay resistance, and auditability, and define an evaluation plan spanning prompt injection, tool misuse, and SSH abuse. The resulting system reframes secret handling for agentic systems from handing the model a key to granting the model a narrowly scoped, non-exportable action capability.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。