{"id":23776,"date":"2026-09-06T19:17:45","date_gmt":"2026-09-06T19:17:45","guid":{"rendered":"https:\/\/scannn.com\/i-trust-my-coding-agents-with-production-secrets-now\/"},"modified":"2026-09-06T19:17:45","modified_gmt":"2026-09-06T19:17:45","slug":"i-trust-my-coding-agents-with-production-secrets-now","status":"publish","type":"post","link":"https:\/\/scannn.com\/lv\/i-trust-my-coding-agents-with-production-secrets-now\/","title":{"rendered":"I trust my coding agents with production secrets now"},"content":{"rendered":"\n
\n

I give my coding agents direct access to important secrets, including my Tailscale auth key, SSH private keys, Anthropic and Codex OAuth tokens, and my Gmail app password.<\/p>\n

<\/p>\n

I\u2019ve worked in datacenters and run Linux infra for decades, worked as a security and network engineer, and built production systems for many companies, including an AI coding agent platform used by hundreds of thousands of people. So I understand the risks involved as well as anyone.<\/p>\n

My setup has all three parts of Simon Willison\u2019s lethal trifecta<\/a>. My agents have access to private data, read untrusted content, and can communicate externally. An attacker could (in theory) hide instructions in a webpage or file that trick an agent into sending them my secrets.<\/p>\n

With production access, my agents can investigate outages, read logs, deploy a fix, and check that it worked. Without that access, I have to do those steps, which slows things down significantly.<\/p>\n

I give agents production access for the same reason I give access to inexperienced teammates. I know a new teammate could install malware or fall for a phishing attack, but I still give them the access they need to do their job.<\/p>\n

I run Claude and Codex exclusively, using frontier models like Astra and Fable for hard problems (Opus and Sol for routine work). I wouldn\u2019t have given older models this much access, but prompt injection worries me a lot less with these models. The models are getting better at distinguishing the user\u2019s instructions from malicious instructions in the content they read.<\/p>\n

This applies to coding agents with access to your own trusted codebase. Opening a random GitHub project with this much access would be a very bad idea<\/strong>.<\/p>\n

Although I trust my agents with secrets now, I still run them in isolated Docker containers. Each agent gets its own checkout and can run dev servers without trampling on another agent\u2019s work. I don\u2019t have to juggle Git worktrees or clean up processes and files my agents leave behind.<\/p>\n

Agents still make mistakes, like running rm -rf<\/code> in the wrong directory. I almost never run them on my bare hosts unless the task requires it.<\/p>\n

But I\u2019m not relying on containers to stop a malicious or hijacked agent from doing damage. My agents still have access to secrets and production machines.<\/p>\n

Ideally we\u2019d follow least privilege<\/a> and give each agent only the access it needs for the task. We may eventually have fine enough control to make that practical without constantly getting in the way.<\/p>\n

But people often talk about merely hiding credentials as if it removes the biggest risk, which is silly. An agent that never sees my SSH private key but gets a root shell on my production server can still rm -rf<\/code> the production system.<\/p>\n

We may want tight controls on agents for a long time, but assuming we\u2019ll always need them is, on some level, a bet against continued dramatic improvements in the models.<\/p>\n

As models improve, we may end up trusting our agents with access even more than we trust ourselves.<\/p>\n<\/div>\n

Source link <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

I give my coding agents direct access to important secrets, including my Tailscale auth key, SSH private keys, Anthropic and Codex OAuth tokens, and my Gmail app password. I\u2019ve worked in datacenters and run Linux infra for decades, worked as a security and network engineer, and built production systems for many companies, including an AI […]<\/p>\n","protected":false},"author":16,"featured_media":23777,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[143],"tags":[],"class_list":["post-23776","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai"],"_links":{"self":[{"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/posts\/23776","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/users\/16"}],"replies":[{"embeddable":true,"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/comments?post=23776"}],"version-history":[{"count":0,"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/posts\/23776\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/media\/23777"}],"wp:attachment":[{"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/media?parent=23776"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/categories?post=23776"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/tags?post=23776"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}