Bitwarden Agent Access SDK integrates with OneCLI for secure credential injection
What this is
Bitwarden has launched an Agent Access SDK that allows AI agents to request credentials from Bitwarden's vault through a human approval workflow. OneCLI is an open-source gateway that implements this SDK by sitting between agents and external APIs, injecting credentials into requests at the network layer.
How it works
Instead of agents fetching and storing API keys in memory (where they're extractable, loggable, and vulnerable to prompt injection), this approach keeps credentials encrypted in Bitwarden's vault until explicitly approved. When an agent needs a credential, it requests access through Bitwarden's SDK, the user approves via Bitwarden CLI, and OneCLI injects the credential into outgoing API requests without the agent ever seeing the raw value.
Key features and configuration
OneCLI proxies every API call the agent makes and handles policy enforcement. The source provides these configuration examples:
# Configure Bitwarden as credential source
onecli provider add bitwarden \
--vault-url "https://vault.bitwarden.com"
Rate-limit API calls per service
onecli rules create
--name "Stripe rate limit"
--host-pattern "api.stripe.com"
--action rate_limit
--rate-limit 10
--rate-window 1h
Bitwarden adds a mature approval workflow backed by enterprise key management. When a user approves a credential request, OneCLI handles the injection and policy enforcement on every subsequent API call.
What users get
- Credentials stay in Bitwarden's encrypted vault until explicitly approved by a human
- OneCLI proxies every API call the agent makes, injecting credentials at the network layer
- Rate limiting and policy enforcement apply to every proxied request
- Audit trail covers both approval (Bitwarden side) and usage (OneCLI side)
- Works with any agent framework that makes HTTP calls to external services
Availability
Both projects are open source. Bitwarden's Agent Access SDK is at github.com/bitwarden/agent-access and OneCLI is at github.com/onecli/onecli. The integration is currently in alpha.
📖 Read the full source: HN AI Agents
👀 See Also
Open-source RAG attack and defense lab for local ChromaDB + LM Studio stacks
An open-source lab measures RAG knowledge base poisoning effectiveness on default local setups with ChromaDB and LM Studio, showing 95% success rate on undefended systems and evaluating practical defenses.
OpenClaw's External Content Wrapper for Prompt Injection Defense
OpenClaw uses an external content wrapper that automatically tags web search results, API responses, and similar content with warnings that it's untrusted, priming the LLM to be skeptical and more likely to refuse malicious instructions.
Security Audit Experiment Shows AI Agent Performance Depends on Knowledge Access
A developer ran three security audits on the same Next.js codebase using different AI approaches: Claude Code's built-in review found 1 critical, 6 high, 13 medium issues; an AI agent without extra context found 1 critical, 5 high, 14 medium; an AI agent with 10 professional security books found 8 critical, 9 high, 10 medium issues.
jqwik v1.10.0 Sneaks Prompt Injection That Deletes Code When Used by AI Agents
Johannes Link added a hidden instruction to jqwik v1.10.0 that tells AI coding agents to delete all jqwik tests and code, concealed with ANSI escapes. Claude correctly flags it, but human users may not be so lucky.