Rotating the key was the easy part
A committed secret is public the moment it is pushed. Deleting the line changes nothing.
security
9 posts
Your agent's tool output is untrusted input
A file the agent reads can contain instructions. The fix has the same shape as SQL injection's.
The cache that returned someone else's data
A cache key missing the tenant is a data leak with a 100% hit rate.
Hashing a password in shared code is the one thing you should not share
Each platform has a vetted crypto provider. A pure-Kotlin implementation has none of their review.
The command that leaked a secret was not on the list
A rule naming forbidden commands cannot hold, because any program that reads bytes can emit them. Enforcing a property of output needs an allowlist.
The on-device privacy argument, stated honestly
Running the model locally is not a privacy guarantee — it is a precondition for one. Only a mechanism that refuses by default makes the boundary real.
Prompt injection does not go away because the model is local
A denylist of three dangerous commands was bypassed by a fourth. Why injection defence has to be allowlist-shaped, and what on-device quietly takes away.
What should an AI agent never be allowed to do?
A permissions model derived from incidents rather than imagination: three tiers, human-only bypasses, and capabilities removed from reach entirely.
The command that leaked a secret was not cat
I leaked an OAuth token by running a command designed to print only field names. The file was malformed, so the field name was the secret. Verb denylists cannot catch this shape.