Audit what's ambient

Twelve hours into an overnight Claude Code run last month, my agent ran the most ordinary command in software: bun test. The test suite inherited the Supabase credentials sitting in its environment, connected to the production database behind my personal knowledge system, and wiped the content tables.

I run my agents behind a gate I’m fairly proud of. Send, execute, delete, pay - anything with external consequence stops and waits for me. That night the gate never fired, because running tests isn’t on anyone’s list of dangerous actions. It’s the opposite. Tests are the thing you run to feel safe.

The mechanics are almost boring. The test suite didn’t ask for production access. It didn’t need to. The credentials were just there, ambient in the environment, and a child process inherits the environment of whatever spawned it. The agent wasn’t reckless and the model wasn’t dumb - this was a frontier model doing exactly what a careful engineer would do, in a shell where the floor happened to be live.

I got the database back the same night. Daily backup, then a file-by-file reconcile, then replaying the day’s entries on top. It worked, and I got lucky that it worked: point-in-time recovery wasn’t enabled, so the daily backup was the only net I had. I still owe myself that one.

Here’s the lesson I keep turning over. Every authorization scheme I’d built - and most of the ones I’ve read - is a list of verbs. Gate the sends, gate the deploys, gate the deletes. But the verb list assumes you know which actions are dangerous, and the whole point of an agent is that it composes actions you didn’t anticipate. Replit’s agent deleted a production database during an explicit code freeze; the freeze lived in the prompt. My gate lived in a verb list. The credentials lived in the environment, and the environment doesn’t read your lists.

The fix shipped the same night, and it’s small. Tests run against an isolated database, enforced by a guard in the test setup that refuses to start if it can reach production. Production credentials are never ambient anymore - they get injected at the moment of an authorized action and exist nowhere else. And there’s a new line in my agent’s operating rules, the kind you only write after: never run the test suite where production credentials are reachable.

The transferable version fits in a question. Not “what can my agent do?” - you already gated that. Ask what every process it spawns can reach without asking. An agent’s real permission set isn’t what you granted it. It’s what’s lying around.

⁂