AWS Agent Toolkit adds guardrails to prevent secrets leaking into AI context

Full analysis

AWS Secrets Manager has introduced a "secret safety skill" in the Agent Toolkit for AWS — an open-source toolkit that equips AI coding agents with tools and guardrails for building on AWS. Previously, AI coding agents could retrieve secrets (API keys, passwords, etc.) as plain text, exposing sensitive values directly inside the agent's context window and session logs. The new skill uses a two-layer approach: the agent is steered so the model never requests or receives a raw secret value, and a separate child process resolves secret references to actual values only at execution time, outside the agent process entirely.

This is a concrete security hardening step for agentic workflows — prompt injection attacks or logging vulnerabilities can no longer expose plaintext secrets through the model context or memory. The skill is available now for Claude Code, Codex, and Cursor via the aws-core plugin, and works in all AWS regions where Secrets Manager is supported.