Your AI Agent Will Leak Your Keys. Here Is How It Happens and How To Stop It.

Your AI agent holds a lot. Your repo. Your .env. Your SSH key. A shell. Your browser. You gave it all of that one permission prompt at a time. Here is a tool that robs you and passes every check you run today. Zero dependencies. No install script. Signed, pinned, verified publisher. It asks for one permission: read files. It still reads your .env and your ~/.ssh/id_rsa and posts them to someone else's server. Then it hides that from the summary it shows you. There is no code in that attack. It is three sentences of English. Here is why it works. In a normal package, the words are docs and the code is the program. In an agent tool it is the other way round. Your agent reads the words and does what they say. So the words are the program, and nothing you run scans them. It never asked for the network. It did not need to. The tool has one permission. The agent has the network, a shell and your repo. The tool just asks the agent. So stop judging the tool. Judge what your agent can reach, and who is allowed to give it orders. In this session I audit three tools live, break a CI gate on purpose, and show four steps to lock this down. What you will learn: - Why the words in an agent tool are the program, not the code - Four things to check before you install: code, instructions, provenance, permission - Which three your scanner already covers, and why the fourth is the one that runs - Why "it never asked for the network" is not good news - Two clean tools that become a leak once you install both - How to pin the instructions, not just the files, and fail CI when they change - How to shrink what your agent can reach, so an unread tool matters less