Rotating the key was the easy part
A committed secret is public the moment it is pushed. Deleting the line changes nothing.
security
12 posts
Your agent's tool output is untrusted input
A file the agent reads can contain instructions. The fix has the same shape as SQL injection's.
The cache that returned someone else's data
A cache key missing the tenant is a data leak with a 100% hit rate.
Hashing a password in shared code is the one thing you should not share
Each platform has a vetted crypto provider. A pure-Kotlin implementation has none of their review.
The biometric prompt belongs to the OS, and it can disappear mid-call
You suspend across a UI the system presents and may destroy without telling you.
Certificate pinning has no shared implementation, and should not
Each engine pins through its own trust machinery, and one cannot pin at all.
There is no shared way to store a secret, and that is the correct answer
Keystore and Keychain hold a key your process cannot read.
The command that leaked a secret was not on the list
A rule naming forbidden commands cannot hold, because any program that reads bytes can emit them. Enforcing a property of output needs an allowlist.
The on-device privacy argument, stated honestly
Running the model locally is not a privacy guarantee — it is a precondition for one. Only a mechanism that refuses by default makes the boundary real.
Prompt injection does not go away because the model is local
A denylist of three dangerous commands was bypassed by a fourth. Why injection defence has to be allowlist-shaped, and what on-device quietly takes away.
What should an AI agent never be allowed to do?
A permissions model derived from incidents rather than imagination: three tiers, human-only bypasses, and capabilities removed from reach entirely.
The command that leaked a secret was not cat
I leaked an OAuth token by running a command designed to print only field names. The file was malformed, so the field name was the secret. Verb denylists cannot catch this shape.