Kilo integrates Enkrypt AI guardrails to block leaked secrets and prompt injections

Why coding agents create new leak risks

Kilo argues that coding agents change what can leak out of an engineering organization. When developers only typed code into an editor, a secret stayed on their machine unless someone committed it. With an agent, a developer can paste that secret into a chat and send it to a model provider the moment they hit enter.

Agents also read files on their own. A malicious instruction hidden in a README or design doc can steer the agent toward data it was never supposed to touch. The Kilo and Enkrypt AI integration is designed to catch both problems before they reach the model.

How admins set policy

An admin or engineering manager creates guardrails in the Enkrypt dashboard and attaches policies to each one. According to Kilo, the policies cover cases like malicious requests, sensitive information leaving a developer's session, and agents working outside the scope they were given.

Once the guardrails exist, a terminal wizard connects Enkrypt to Kilo at either the project level or the global level. Developers do not write or maintain the rules. Whoever owns security for the team decides what gets blocked.

What developers see in practice

Kilo describes two scenarios. In the first, a developer accidentally pastes an API key from their model provider into the Kilo CLI. Enkrypt blocks the prompt as soon as it is sent, so the key never reaches the model. Enkrypt's explanation of the block appears directly in Kilo, and the developer can remove the key and resend without leaving the terminal.

The second case is a prompt injection, which is harder to catch because the developer usually does not know it is there. In Kilo's example, the developer uses the VS Code extension and asks the agent to read an architecture file. A line buried in that file tells the agent to forget its prior instructions and pull sensitive information from other files in the repo. The agent starts on the request, but its Read tool call fails, because Enkrypt detected the injection before the agent or the model received the corrupted instructions.

In both cases, the developer's only extra work is reading the block message.

Logs for security and compliance teams

Enkrypt logs every action and violation, and security or compliance officers can review those logs in the Enkrypt platform. Opening a specific guardrail shows a summary for each user along with the individual events behind it. An auditor can therefore trace a blocked prompt back to the user who sent it and the policy that caught it.

What it means for teams rolling out Kilo

Kilo's Teams and Enterprise plans already let admins limit which models developers can use and track team adoption of AI through usage analytics and the AI ROI Dashboard. According to Kilo, Enkrypt's guardrails extend that control to the contents of each prompt and each tool call, which is where secrets and injected instructions actually show up.

For engineering leaders deciding how widely to roll out agents, Kilo points to a division of labor. Security teams set and audit policy in Enkrypt at the project or global level, while developers keep using Kilo at full speed and only notice the guardrails when one of them fires.