I trust my coding agents with production secrets now

A veteran security engineer now hands core secrets like SSH private keys and OAuth tokens directly to AI coding assistants. The credentials live in a password vault and the agents usually call them without ever seeing the plaintext.

Many would call this suicidal: the assistants can read private data, ingest untrusted content, and send messages externally — completing what Simon Willison calls the 'lethal trifecta.' In theory, a malicious webpage could trick an agent into leaking secrets.

Security is always a tradeoff between productivity and risk

With production access, an agent can investigate outages, read logs, deploy fixes, and verify them itself, saving the author many manual steps. He trusts agents for the same reason he gives access to inexperienced teammates: mistakes are possible, but the job requires it.

The key change is the models. The author runs only frontier models like Claude and Codex, which are far better at distinguishing user instructions from malicious instructions in the content they read, so prompt injection worries him much less. But this applies only to a trusted codebase; opening a random GitHub project with such access would be reckless.

Container isolation isn't about hackers

Even with this trust, the author still runs agents in isolated Docker containers. This is mostly to contain 'child-like' accidents — like running rm -rf in the wrong directory or stepping on each other's processes — not to stop a malicious actor.

As for least privilege, the author argues that merely hiding credentials is self-deception: an agent with a root shell on a production server can still nuke the whole system. The real solution is continued improvements in model capability. Someday we may trust our agents even more than we trust ourselves.