Angelina YangFounder and Host, TwoSetAI · AI builder for visibility and discoverability

Why You Should NEVER Give an AI Agent an API Key

1 Apr 2026 · 0 min

Watch on YouTube

0:29

In this segment, Angelina Yang warns that providing an AI agent with an API key is a major security vulnerability. She explains that once an agent possesses a key, it can misuse it by sending the key to any external destination—such as a hacker‑controlled URL, a social‑media platform, or other services—effectively leaking the credential. The speaker emphasizes the need for extreme caution and recommends a safer architecture: let the agent request that a specific API be called, but handle the actual key and request outside the agent’s runtime, using a controlled proxy or manual approval process.

Yes, you just don't want to give an agent an API key. That's the biggest problem. But now you're telling this agent, hey, you have the ability to talk to any API anywhere on the internet. And also, here's an API key. It could take your API key and then just send it anywhere. It could post it to some hacker's URL. It could post it on your Facebook. Like, it could post it anywhere. And so that's why you have to be incredibly careful. But instead, letting the agent tell you, I want you to talk to this API, and then you're able to go and handle that sort of outside the scope of the agent.