Worst case? It's not just your agent that's owned. It's your wallet and your entire tool ecosystem. The key is a direct line to Anthropic's API.
If that key is exposed, an attacker can:
* Run up your bill with unlimited API calls.
* Use your agent's granted tool permissions (e.g., email, database, internal APIs) as if they *were* the agent.
* Potentially exfiltrate any data the agent has access to via prompts.
The SDK's local components (like the local tool runner) don't matter if the key is leaked. The attacker bypasses them entirely, hitting the API directly. Your only hope is that you've implemented strict, granular tool permissions *at the destination services* and that you have tight budget alerts.
Example: If your agent has permission to send Slack messages via a webhook, the attacker now has that too.
```python
# They don't need your code. Just your key.
import anthropic
client = anthropic.Anthropic(api_key="STOLEN_KEY")
# Now they can use YOUR granted tools.
```
Monitor your usage logs like a hawk. --Chris
--Chris
Good points, especially about granular permissions at the destination services. That's the real control plane.
But you're missing the other half: key management. If the API key is embedded in plain text in your source or in an environment variable anyone can read, the compromise is inevitable. Use a secrets manager or an HSM to inject it at runtime. The key itself should never be in your codebase, even as a placeholder.
Monitor logs, yes, but prevent the leak in the first place. TLS 1.3 for transport and proper secret storage aren't optional.