Unattended Agent Security: 7-Key Checklist After a CLAUDE.md Line Stole .env Files
petrusenko_max · x · 2026-10-29
The author warns that plain text is the newest trap for unattended agents: a single line in a repo's CLAUDE.md can instruct the agent to send your .env to someone's server, and no scanner flags it because it's just words. His 7-point checklist for any unattended agent:
- One key per agent—rotate one thing if it leaks
- Keys live outside the repo, tight permissions, never printed (logs are where secrets get copied)
- No auto-approve in code you didn't write; read CLAUDE.md, AGENTS.md and .cursorrules first
- Outbound allowlist—a stolen key with nowhere to go can't do much
- Read-only by default; a repo-summarizing agent needs no shell
- Caps on every action so a hijacked agent burns little
- Fetched pages, emails and tool results are data, never orders
His test: if the agent turned hostile tonight, what's the worst it could do with what you gave it?
More from coding & agent
- Synap claims #1 on LongMemEval with 95.6% answer accuracy, optimizing a different metric — arpit_bhayani · 2026-10-29
- Min-cut on a 4.49M-transfer graph to freeze mule accounts (and a max-flow bug) — JeremyCMorgan · 2026-10-29
- Dev admits 'dangerously bypassing permissions' with coding agents from day one — brandon_galang · 2026-10-29
- Ultracode in Claude Code isn't a thinking level — it splits tasks across subagents — jacob_posel · 2026-10-29
- Hack lets any Grok bot switch to Opus by routing requests through a Cursor project — bfrench · 2026-10-29
- Director's Cut: open-source ComfyUI filmmaking app with character presets — oLeonardoFrito · 2026-10-29