--- title: Kilo Cloud Agents: We Took the Keys Out of the Box description: Kilo's Cloud Agents now use a short-lived, sandbox-specific capability token instead of passing real GitHub or Kilo credentials into the sandbox environment.... canonical: https://daily.dev/posts/kilo-cloud-agents-we-took-the-keys-out-of-the-box-okmxsia4b twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Kilo Cloud Agents: We Took the Keys Out of the Box | daily.dev og:description: Kilo's Cloud Agents now use a short-lived, sandbox-specific capability token instead of passing real GitHub or Kilo credentials into the sandbox environment.... og:url: https://daily.dev/posts/kilo-cloud-agents-we-took-the-keys-out-of-the-box-okmxsia4b og:image: https://api.daily.dev/og/posts/OkmxSia4b.png og:image:alt: Kilo Cloud Agents: We Took the Keys Out of the Box og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Kilo Cloud Agents: We Took the Keys Out of the Box **[Kilo Blog](https://daily.dev/sources/kilo-ai-blog)** · 4 min read · 1 upvotes · 0 comments ## Summary Kilo's Cloud Agents now use a short-lived, sandbox-specific capability token instead of passing real GitHub or Kilo credentials into the sandbox environment. The real tokens never touch the container — instead, outbound requests are intercepted and validated against three checks (token authenticity, allowed destination, and sandbox binding) before the real credential is swapped in for a single request. This means even if a token is intercepted or leaked, it cannot be used outside the specific sandbox it was issued to, and only for the duration of that sandbox's lifetime. GitLab support using the same architecture is planned next. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Kilo prevent AI coding agents from exposing real GitHub tokens inside sandboxes? Kilo Cloud Agents no longer place real GitHub or Kilo tokens inside sandbox containers. Instead they mint a short-lived, sandbox-specific capability token that looks like a credential but cannot be reconstructed into the real one and only works from the sandbox it was issued to. Outbound requests are intercepted using a Cloudflare feature, validated against three checks (authenticity, allowed destination, matching sandbox), and only then swapped for the real token to forward upstream, which never touches the sandbox's environment, disk, or logs. _For teams giving agents real API access, daily.dev surfaces how credential isolation approaches like this are evolving._ ### What happens if a capability token issued to a Kilo Cloud Agent sandbox is intercepted or leaked? An intercepted or leaked capability token is useless outside the single sandbox it was scoped to, because each token is bound to one specific container and validated against that binding before any request is forwarded. It also only remains a live credential for as long as that sandbox exists, limiting the exposure window even if a prompt injection or bad dependency exfiltrates it. _Engineers hardening AI agent pipelines can track credential-scoping techniques like this through daily.dev._ ## Similar posts on daily.dev - [Cloud Agents Just Got a Major Upgrade](https://daily.dev/posts/cloud-agents-just-got-a-major-upgrade-tr9v1eaio) · Kilo Blog · 1 upvotes · 0 comments - [The Security Architecture of GitHub Agentic Workflow](https://daily.dev/posts/the-security-architecture-of-github-agentic-workflow-6pggsl2hu) · ByteByteGo · 43 upvotes · 0 comments - [How GitHub Is Securing Agentic Workflows in Modern CI CD Systems](https://daily.dev/posts/how-github-is-securing-agentic-workflows-in-modern-ci-cd-systems-hmvfef9s3) · InfoQ · 0 upvotes · 0 comments - [Agents have their own computers with Sandboxes GA](https://daily.dev/posts/agents-have-their-own-computers-with-sandboxes-ga-bvcsfels6) · Cloudflare · 3 upvotes · 0 comments - [The Agent Never Sees the Key: Proving Credential Brokering in DigitalOcean Action Gateway](https://daily.dev/posts/the-agent-never-sees-the-key-proving-credential-brokering-in-digitalocean-action-gateway-whpn33mhj) · DigitalOcean Community · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#cloudflare](https://daily.dev/tags/cloudflare) [View this post on daily.dev](https://daily.dev/posts/kilo-cloud-agents-we-took-the-keys-out-of-the-box-okmxsia4b) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Kilo Cloud Agents: We Took the Keys Out of the Box","url":"https://daily.dev/posts/kilo-cloud-agents-we-took-the-keys-out-of-the-box-okmxsia4b","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/kilo-cloud-agents-we-took-the-keys-out-of-the-box-okmxsia4b"},"datePublished":"2026-07-13T20:05:24.135Z","dateModified":"2026-09-14T07:49:51.715Z","description":"Kilo's Cloud Agents now use a short-lived, sandbox-specific capability token instead of passing real GitHub or Kilo credentials into the sandbox environment....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b28bf3da6923c7dbad04fd5f576ff534?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b28bf3da6923c7dbad04fd5f576ff534?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Kilo Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Kilo Blog","logo":"https://media.daily.dev/image/upload/s--x3pmrf8D--/f_auto,q_auto/v1774964071/logos/kilo-ai-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/kilo-ai-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/kilo-cloud-agents-we-took-the-keys-out-of-the-box-okmxsia4b","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,cloudflare","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Kilo Blog","item":"https://daily.dev/sources/kilo-ai-blog"},{"@type":"ListItem","position":3,"name":"Kilo Cloud Agents: We Took the Keys Out of the Box"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/kilo-cloud-agents-we-took-the-keys-out-of-the-box-okmxsia4b#faq","mainEntity":[{"@type":"Question","name":"How does Kilo prevent AI coding agents from exposing real GitHub tokens inside sandboxes?","acceptedAnswer":{"@type":"Answer","text":"Kilo Cloud Agents no longer place real GitHub or Kilo tokens inside sandbox containers. Instead they mint a short-lived, sandbox-specific capability token that looks like a credential but cannot be reconstructed into the real one and only works from the sandbox it was issued to. Outbound requests are intercepted using a Cloudflare feature, validated against three checks (authenticity, allowed destination, matching sandbox), and only then swapped for the real token to forward upstream, which never touches the sandbox's environment, disk, or logs. For teams giving agents real API access, daily.dev surfaces how credential isolation approaches like this are evolving."}},{"@type":"Question","name":"What happens if a capability token issued to a Kilo Cloud Agent sandbox is intercepted or leaked?","acceptedAnswer":{"@type":"Answer","text":"An intercepted or leaked capability token is useless outside the single sandbox it was scoped to, because each token is bound to one specific container and validated against that binding before any request is forwarded. It also only remains a live credential for as long as that sandbox exists, limiting the exposure window even if a prompt injection or bad dependency exfiltrates it. Engineers hardening AI agent pipelines can track credential-scoping techniques like this through daily.dev."}}]} ```