TruffleHog Creator: You Can’t Have AI Agents Without Secrets

**Dylan Ayrey** (0:00)
It used to be the bottleneck was code development, and now the bottleneck is secrets. It's literally the thing that makes developers slowest to get things in production right now. The thing that's preventing us from moving as fast as the speed of the agent being able to write the code is the secrets. And that's what we're mission to clear up and to solve. The financial impact of these secrets is now more immediate. It's definitely put some more immediate emphasis where somebody says, okay, this is a problem today. The day that the secret leaked, I can see it's a problem.
I don't see it four years later when we finish arguing about whether or not that is or isn't our database.

**SPEAKER_2** (0:34)
If you can't robustly protect your secrets, you can't have reliable AI agents. Truffle Security is an a16z backed cybersecurity startup with the goal of identifying and fixing exposed secrets, such as passwords and API keys before they get picked up and exploited by hackers. Truffle's main product, Truffle Hog, started out as an open source project on GitHub before exploding in popularity and has now been downloaded over 15 million times. On this episode, Truffle's co-founder and CEO, Dylan Ayrey, joins a16z partner, Joel de la Garza, to discuss the emergent security stack for AI agents, why leaks are actually getting worse, and how Truffle evolved from an open source side project to a major VC backed startup. Let's get into it.

**Joel de la Garza** (1:16)
You know, we've been talking for the last couple weeks now that 2026 is really shaping up to be the year of the agents. We've been talking about the agent stack, what is an agent, identity in agents, security in agents, observability. It's been agents nonstop. And so really grateful to have you, Dylan, coming on the podcast today, to talk about secrets and agents. And maybe as the CEO and founder and co-founder of Truffle Security, you could start off by telling us what Truffle Security does and kind of what you focus on. Yeah.

**Dylan Ayrey** (1:44)
So Truffle Security is a company built on top of a very popular open source cybersecurity tool called Truffle Hog. Truffle Hog has ran something like a quarter million times every day worldwide by security practitioners. It's been starred 23,000 times on GitHub. Within that is 8,000 different organizations that have mashed the like button. So it's ubiquitous within cybersecurity. If you're outside of cybersecurity, it's the most popular tool for finding machine or non-human secrets. What do I mean by that? Well, Joel is a human. He logs into Netflix with a password. A machine logs into a machine with a secret. And so that could take the form of a database password. It could take the form of a piece of cryptographic material or it could take the form of just a random long token. For a very long time, they've been really difficult to use through no fault of developers, just from a lack of mature tooling. And that's caused them to leak out a hundred different ways. And so I wrote Truffle Hog as a passion project back in 2016 as a tool that's just meant to go out there and find those secrets in all the places where we don't want them. And every developer on the planet, myself included, has accidentally published a machine secret to a code repository. There are a lot of different ways it can happen. Truffle Hog is very good at finding when it happens. Validating that key is live, analyzing what that key can actually do, confirming that yes, it does in fact have access to customer data. It does in fact have access to sensitive data. And if you're a defender, helping to get that key revoked. If you're an attacker, there are no offensive capabilities within Truffle Hog, but everything I just described is usually enough information for an attacker to then go and build an additional step and take that key and do something malicious. So Truffle Hog for a long time has kind of sat that purple team. Like red teamers can come in and use it to find the sensitive keys and then script up some bad things with it. Blue teams have used it to go in and find keys and then get them revoked. And that's been the legacy of Truffle Hog.

**Joel de la Garza** (3:42)
It's interesting too, because the rise of secrets as a problem is pretty much correlated directly to cloud, right? So I think in the olden days, everything was on-prem, it was in your data center. You couldn't just telnet to it or connect to it or SSH or whatever. You had to actually go to the data center, plug into the local network and then get access to it. So people typically would use things like username and password. And that was sort of the original secrets. The first transmission across the Internet in history was actually an attempt to log in, right? So it's ingrained in the Internet. And then cloud came along and created these secrets which you described. But it seems like as we've come further, like it's no longer just about getting access to things. Secrets are performing a lot of other functions.