Critical security coverage: two distinct threat surfaces (disk exposure vs prompt injection), Bitwarden Secrets Manager setup in 5 minutes, and why Bitwarden does NOT stop prompt injection. Agent Vault is the only solution that fully closes the prompt injection vector.

Watch on YouTube

Critical Security Note

Bitwarden Secrets Manager does NOT prevent prompt injection attacks. Keys go from disk to OS environment - they are still present in memory and accessible to a successful injection. Agent Vault is required to fully close this attack surface.

The Two Threat Surfaces

Threat 1: Keys on disk.env file in plain text. If someone accesses the filesystem, they have all keys. Found in Hermes session transcript files too.

Threat 2: Prompt injection Malicious text on a web page instructs the agent to output its environment variables. The agent reads it and complies. This is independent of whether keys are on disk or in OS memory.

These are separate problems requiring separate solutions.

Bitwarden Secrets Manager (Solves Threat 1)

5-minute setup:

1. Create account at Bitwarden Secrets Manager (separate from Password Manager)
2. Create a project: "Hermes keys"
3. Add each API key as a named secret (e.g., "OpenRouter API Key")
4. Create machine account, add your project, grant read access
5. Generate an access token, save it securely
6. In Hermes terminal: hermes secrets -> provide the access token
7. Test: hermes model shows "Applied 1 secret: [key name]"

What this fixes: Keys no longer in .env on disk. Central management from one Bitwarden interface. Rotate any key without touching 15+ provider dashboards.

What this does NOT fix: Bitwarden retrieves keys and stores them in OS environment. A malicious web page can still instruct the agent to output its environment variables. Keys are not on disk but ARE in memory.

Agent Vault (Solves Both Threats)

Agent Vault is a secrets broker, not a retrieval system.

Architecture: Only a placeholder token exists where the key would normally be. On every API call, the actual key is fetched in real time from a separate broker VPS.

Result: Keys are never present in the agent's environment. A successful prompt injection attack finds no keys to steal.

Factor	Bitwarden Secrets Manager	Agent Vault
Setup time	5 minutes	30-60 minutes
Keys on disk	No	No
Keys in OS environment	Yes	No
Stops prompt injection	No	Yes
Network dependency	Startup only	Every API call
Best for	Private boxes, single machine	Internet-exposed agents

Decision Rule

Use Bitwarden minimum for any agent doing scraping, social media crawling, or email triage.

Use Agent Vault for agents exposed to the internet or running dirty tasks (reading untrusted content at scale).

Private instance, not reading third-party content: standard .env is acceptable risk.

Fleet Application

Any fleet agent that reads untrusted web content should have keys in Bitwarden Secrets Manager at minimum. Agent Vault is the target state for agents like Raven (research, competitor intel) or any agent crawling third-party sites at scale.

As of this video, Agent Vault is not yet fully deployed in production by Nemanja. A dedicated setup video is planned.