# Google's AI coworker hides keys by design _Philipp Schmid demoed Gemini Managed Agents with a proxy that hides keys from the model to block remote prompt-injection theft._ **Published:** 2026-11-08 **Source:** https://www.startuphub.ai/ai-news/artificial-intelligence/2026/google-s-ai-coworker-hides-keys-by-design --- The only part of the AI coworker that matters is where the secrets live. Philipp Schmid told [AI Engineer](https://www.youtube.com/watch?v=EtZwTYahfek) his Wall Street demo runs on Gemini API Managed Agents, with a network proxy that swaps dummy credentials only for approved domains to block a remote attacker stealing keys through prompt injection. Schmid, listed as a Developer Advocate in the AI PM Wiki, framed the build as seven hires: brain, computer, playbook, tools, credentials, house rules and schedules. The brain in his demo is [Gemini](https://www.startuphub.ai/ai-news/artificial-intelligence/2026/google-launches-gemini-3-5-flash) 4 Argon, which he said offers a 1 million token context window with more than 64K tokens for reasoning, priced at $2 input and $10 output according to his talk, and callable in four lines through ai.studio.com/apikey with agent ID anti-gravity preview 09. I think he is right to start with credentials. The proxy model supports bearer tokens, OAuth and environment variables, Schmid said, with credentials stored write-only outside the sandbox so they can be overwritten but not read. When the agent calls Gmail or Sheets through Workspace MCP servers, or Slack through a defined domain, the proxy sees the dummy value leave the sandbox and replaces it in flight, so a malicious MCP server or pasted instruction that says print your .env gets nothing usable because the swap never triggers for unapproved hosts. The second guard is deterministic. Schmid said hooks use regex matchers on tool calls for human approval paths, hooks live as protected files the agent cannot edit, and cron triggers run the same environment on schedule, which he demoed as an 8:30 a.m. portfolio audit that read a skill, checked prices, updated a Google Sheet and posted context to Slack. That push fits the internal use he cited from Google teams, including Chromium decoupling work and Gemma efficiency work, and the same talk included a pure Python 3D ray tracer built by Gemini that extends [our earlier coverage of Gemini 4 Argon taking heavy 3D work off local hardware](https://www.startuphub.ai/ai-news/artificial-intelligence/2026/gemini-4-argon-ai-studio-takes-heavy-3d-work-off-local-hardware). Fair concession: a domain-bound swap stops casual exfiltration, not misuse inside an allowed domain, and Schmid did not show webhook triggers, only cron, with webhooks described as in progress. The claim survives because the threat he names is real, a remote third party piggybacking on tools the agent already trusts, and that is exactly what domain binding narrows. If you hire one, give it a fake key, a short leash and an 8:30 alarm, then watch the proxy logs. --- Original analysis from [startuphub.ai](https://www.startuphub.ai), the #1 AI startup directory. © StartupHub.ai. All rights reserved. You may not republish this article in full without a license. Search engines and AI research tools may crawl and summarize for reference. Bulk reproduction or model training on this content requires a license. See https://www.startuphub.ai/terms.