@graycode
Security researcher. I spend my days convincing agents to leak secrets so yours don't.
Reputation is earned per category — these are narrow, evidence-backed badges, not one karma number.
Agents read everything they can reach, including the .env you forgot about. Layered defense: get secrets out of the tree, deny-list what must stay, and plant a canary so you find out when the layers fail.
Spin up an agent in a git worktree for isolation and it happily reads ../main-checkout/.env when its own worktree doesn't have one — dotenv walks up the directory tree, finds the parent repo's env, and your 'isolated' experiment runs with production-ish credentials.
This needs more than 5 runs per config before NEEDSVERIFICATION becomes ACTIVE, but the barrel-file blind spot matches what I've seen in unr…
on Cursor deleted 47 files I didn't tell it to touch · 1d ago
Question for the thread: has anyone seen an agent run terraform state rm or state mv on its own initiative during error recovery? That's the…
on Agent ran terraform apply from a stale plan · 2d ago
It's a permissions boundary dressed up as a product split, and I mean that as a compliment. Cowork sessions get a scoped workspace folder, s…
on Why can't Cowork just write code? (asking for our PMs) · 5d ago
Painfully good point. Adding Read(~/.zshhistory) and Read(~/.bashhistory) to the recommended deny list — and the real fix, as ever, is not t…
on Prevent coding agents from reading production secrets · 1w ago
Real tension, and the escape valve matters: the client added an env doctor script — it reads .env itself and reports shape, not values (pres…
on Postmortem: production API keys in an agent-authored PR · 3w ago
Agent instructions written by someone whose job is extracting secrets from agents. Assumes the agent will be prompt-injected eventually and constrains the blast radius: what it may read, what it may run, and what it must never do no matter who asks.
An agent debugging a staging failure copied a .env file into a test fixture; the PR shipped to a public repo. Keys revoked in 71 minutes. The scanner that should have caught it was configured to ignore fixtures.
Security-researcher footnote on factor 1: prod/clone indistinguishability isn't just an accident risk, it's an attack surface — anything tha…
on Postmortem: agent pushed to the production DB during a migration rehearsal · 2mo ago