企業仍然需要配合 MCP allowlist、vault policy 同程式碼審查等安全措施，以避免工具配置或 AI 生成程式碼帶來風險。
How does the new partnership between OpenAI and 1Password improve security for the Codex AI coding agent, and how does the integration workModern AI coding agents can request credentials through secure tools instead of exposing secrets directly to the model.
AI 提示
Create a landscape editorial hero image for this Studio Global article: How does the new partnership between OpenAI and 1Password improve security for the Codex AI coding agent, and how does the integration work. Article summary: The OpenAI–1Password pattern can improve Codex security by moving secrets out of prompts and model inputs, and instead letting Codex request narrowly scoped credentials through a mediated tool path; 1Password warns that . Topic tags: general, documentation, general web, user generated. Reference image context from search candidates: Reference image 1: visual subject "Coding agents are now writing production features on real development teams, and a new report from DryRun Security shows that those agents introduce security vulnerabilities at a h" source context "AI coding agents keep repeating decade-old security mistakes - Help Net Security" Reference image 2: v
openai.com
AI 編程代理（例如 OpenAI 的 Codex）可以寫程式、執行指令、甚至呼叫 API。不過一旦要做真正嘅工作，例如部署服務或連接雲端平台，就必須用到憑證（credentials）：例如 API keys、存取 token 或密碼。
過去好多開發者會直接將 API key 貼入 prompt，或者放喺 .env 設定檔。呢個做法其實好危險——因為一旦機密資料進入模型嘅 context window（上下文），就可能出現在日誌、生成程式碼、或者其他輸出入面，開發者未必可以再控制佢流向邊度。
OpenAI 同 1Password 最近提出一種更安全嘅整合模式：將機密資料完全隔離出 AI 模型本身。AI 只負責協調任務，而真正嘅憑證由安全工具按需要提供。
問題核心：機密資料進入模型上下文
當開發者將 API key 或密碼直接貼入 prompt 時，其實等同將憑證傳送到模型 API，並可能被寫入 session log 或生成文件。
1Password 指出，將原始憑證直接暴露畀 AI 模型存在重大風險，因此建議盡量避免將 secrets 傳入模型。更安全嘅做法係使用短期、權限受限嘅憑證，同時限制模型對敏感資料嘅直接存取。
企業仍然需要配合 MCP allowlist、vault policy 同程式碼審查等安全措施，以避免工具配置或 AI 生成程式碼帶來風險。
How does the new partnership between OpenAI and 1Password improve security for the Codex AI coding agent, and how does the integration workModern AI coding agents can request credentials through secure tools instead of exposing secrets directly to the model.
AI 提示
Create a landscape editorial hero image for this Studio Global article: How does the new partnership between OpenAI and 1Password improve security for the Codex AI coding agent, and how does the integration work. Article summary: The OpenAI–1Password pattern can improve Codex security by moving secrets out of prompts and model inputs, and instead letting Codex request narrowly scoped credentials through a mediated tool path; 1Password warns that . Topic tags: general, documentation, general web, user generated. Reference image context from search candidates: Reference image 1: visual subject "Coding agents are now writing production features on real development teams, and a new report from DryRun Security shows that those agents introduce security vulnerabilities at a h" source context "AI coding agents keep repeating decade-old security mistakes - Help Net Security" Reference image 2: v
openai.com
AI 編程代理（例如 OpenAI 的 Codex）可以寫程式、執行指令、甚至呼叫 API。不過一旦要做真正嘅工作，例如部署服務或連接雲端平台，就必須用到憑證（credentials）：例如 API keys、存取 token 或密碼。
過去好多開發者會直接將 API key 貼入 prompt，或者放喺 .env 設定檔。呢個做法其實好危險——因為一旦機密資料進入模型嘅 context window（上下文），就可能出現在日誌、生成程式碼、或者其他輸出入面，開發者未必可以再控制佢流向邊度。
OpenAI 同 1Password 最近提出一種更安全嘅整合模式：將機密資料完全隔離出 AI 模型本身。AI 只負責協調任務，而真正嘅憑證由安全工具按需要提供。
問題核心：機密資料進入模型上下文
當開發者將 API key 或密碼直接貼入 prompt 時，其實等同將憑證傳送到模型 API，並可能被寫入 session log 或生成文件。
1Password 指出，將原始憑證直接暴露畀 AI 模型存在重大風險，因此建議盡量避免將 secrets 傳入模型。更安全嘅做法係使用短期、權限受限嘅憑證，同時限制模型對敏感資料嘅直接存取。
agentpatterns.aiSecrets Management for AI Agents: Credential Injection
developer.1password.comhttps://developer.1password.com/llms-sdks.txt
1password.devSecure AI access - 1Password Developer Tools
developers.openai.comModel Context Protocol – Codex | OpenAI Developers