LoginSign Up
← Back to all sparks
I

Infisical

INFRA · APIS
Velocity8.8

Open-source secret management platform for developers

infisical.com ↗

Infisical launches Agent Vault: credential-free secret injection for AI agents.

agent-vaultsecrets-managementpampkiai-agentsenterprise-security
◆Current state
Infisical is shipping 10+ patch releases over two weeks, advancing three parallel fronts: Agent Vault (credential-free runtime secret injection for AI agents, now out of preview), PAM (privileged access with break-glass, Oracle and Snowflake managed targets, and one-to-many LDAP), and PKI (custom X.509 extensions, certificate audit logs, and license-gated enterprise features). The v3 UI migration is an ongoing background workstream touching nearly every console page without changing product surface.
◆Where it's heading
Agent Vault's arc is clear: from an external documentation link two weeks ago to a launch modal, stripped preview callout, and dedicated quickstart docs by September 18. The product addresses a specific blocker in enterprise AI deployments—the paradox where an AI agent needs credentials to fetch the credentials it needs to operate. PAM is expanding methodically, adding managed targets (Oracle, Snowflake) and enterprise access patterns (break-glass, LDAP fan-out) one release at a time, building the account-privilege layer that large organizations require before putting secrets management in the critical path.
◆Prediction
Agent Vault will reach GA within a few releases given the docs overhaul, intro modal, and preview-callout removal already shipped. The INFISICAL_RUN_MODES flag introduced in v0.165.9 suggests work on a lighter deployment footprint—likely a mode tuned for edge or embedded agent environments—which would directly complement the Agent Vault pitch to teams deploying AI at scale.

◆Recent moves

  1. 1d ago

    Agent Vault Intro Modal and PKI Sync Filters

    Agent Vault moves further out of preview with a product intro modal and the removal of the preview callout in docs. PKI sync gets per-filter certificate selection—useful for operators managing multiple certificate templates. The paywall-to-billing funnel tracking is internal instrumentation rather than a product change.

    View source ↗
  2. 3d ago

    Oracle PAM Restored, PKI Audit Logs, AWS ISO Region KMS

    Oracle Database returns as a managed PAM target after being absent, filling a gap for enterprises running Oracle in the critical path. PKI certificate audit log details give operators visibility into certificate lifecycle events. AWS ISO/ISOB region support for external KMS extends the platform's reach into regulated government environments.

    View source ↗
  3. 4d ago

    Agent Vault Launches: AI Agents Now Run Without Credentials

    ⚡ SPARK

    Agent Vault ships as a preview feature, enabling AI agents to run without holding any credentials of their own—the platform injects secrets at runtime instead. Combined with making the relay component optional and adding Snowflake as a PAM target, this release is the most architecturally significant of the batch.

    View source ↗
  4. 9d ago

    Validation Rule API Revamp and PKI Certificate Profiles for Imports

    The validation rule API gets a revamp, giving operators more structured control over secret validation policies. PKI now supports attaching certificate profiles to imported certificates—a gap that forced manual workflows for certificates not issued directly by Infisical's CA. Vault migration gains folder creation support.

    View source ↗
  5. 10d ago

    Global Command Menu, PKI License Gating, and KMS-Derived Cookie Signing

    A global command menu arrives, making the console navigable by keyboard across all resource types—a meaningful UX shift for operators managing large secret stores. Cookie signing keys now derive from the KMS root key rather than a static secret, tightening the security posture. PKI moves behind license gating, signaling commercial intent for the certificate management surface.

    View source ↗
  6. 12d ago

    v0.165.8

    This release bounds HTTP metric cardinality to prevent observability costs from growing unbounded and fixes an HP iLO rotation prompt fragmentation issue. Both are operational reliability fixes with no visible product change.

    View source ↗