Coding agents are the most capable users your laptop has ever had. Here is how we let them work without handing them a single secret.

October was a bad month for secrets on disk

A coding agent runs as you. Anything your account can read, it can read, and anything it reads it can be talked into sending somewhere. Four incidents in four weeks showed what that means in practice.

On October 8 a malicious release of the tensorlake npm package ran a preinstall hook that collected SSH keys, .env files, npm and GitHub tokens, AWS credentials, and the configuration and MCP files of Claude, Cursor, Kiro, Windsurf and Zed. Socket flagged it 11 minutes after publication.

On October 14 Noma Labs published SneakPeek: a padded file disguised as a coverage report, sitting in a public repository. Ask Claude Code Desktop to review it and the preview pane rendered it, and the payload could read SSH private keys, AWS access keys, npm and GitHub tokens, Kubernetes and Docker credentials, and Claude’s own OAuth token. It was reported on July 4 and fixed on August 17.

On October 21 LiteLLM 1.107.0 shipped to PyPI with a credential stealer that gathered SSH private keys, GPG keys, shell history, AWS, GCP and Azure credentials, browser logins and AI provider API keys. It was quarantined in about two hours.

On October 25 BleepingComputer reported a malicious AGENTS.md in a Downloads folder that made Codex install a rogue npm package, and a CLAUDE.md variant that exposed Claude Code’s OAuth token. The researchers’ verdict was that there was nothing to patch: the agents followed the instructions in their working directory as designed.

The other side is automated too. OpenSSH released 10.6p2 on November 5 and noted that bugs found with AI assistance are now being independently rediscovered by others, so the project ships fixes more often instead of batching them. Attackers and defenders have the same tools, and both run faster than a human reads.

Five dated events, four of them credential thefts through agents or their supply chain, in the four weeks before this post.

The common thread is a secret that sits still

None of the four attacks broke cryptography. They read files. An SSH private key is a file. AWS credentials are a file. An OAuth token is a file. A NOPASSWD line in sudoers is a file, and even without one, sudo remembers your password for five minutes by default. Every one of these is a standing credential: it works whether or not you are at the keyboard, and it works for whoever holds the bytes.

An agent with a shell is a user who reads faster than you, follows instructions it finds in files, and will paste whatever it is told to paste. Guardrails inside the agent help, and every vendor above has them. They lost anyway, because the thing worth stealing was lying on disk in the agent’s own working directory. The durable fix is not a better prompt. It is having nothing on the machine worth taking.

Top: a key on disk is read and carried off by whatever runs as you. Bottom: the key stays in the phone, the laptop only sends signing requests, and there is nothing for an attacker to copy.

The industry is converging on a human in the loop

In February NIST’s National Cybersecurity Center of Excellence published a concept paper on software and AI agent identity and authorization, covering identification, authorization, auditing and non-repudiation of agents, and controls against prompt injection. At RSAC in March, Yubico, IBM and Auth0 announced a partnership to secure agentic AI with what Yubico calls “hardware-backed human proof of presence authorization”: the agent does routine work alone, and a person with a hardware key approves the actions that matter.

We agree with the shape of that answer, with one difference. The hardware is the phone you already carry, and proof of presence is literal. The phone has to be within Bluetooth range of the computer, or nothing happens.

How we let an agent run sudo, ssh and git

This is how our own machines are set up. Your SSH key is generated inside the phone’s Secure Element and never leaves it. The Allthenticate service on the computer exposes an ordinary SSH agent socket, so ssh, scp, git and anything else that speaks the agent protocol works unchanged. When one of them needs a signature, the request travels over a mutually authenticated Bluetooth channel to the phone, the phone signs, and the signature comes back. The private key is never on the computer, so there is no file for an agent, a stealer or a preview pane to read.

Git commit signing uses the same key, so a commit pushed by an agent still carries proof that you were physically present when it was signed. Sudo goes through PAM on macOS and Linux: the module asks the service, the service asks the phone, and no password is typed, stored or cached anywhere on the machine.

You choose, per service, how much the phone should ask of you. Presence means the phone only has to be nearby; the answer comes back in a fraction of a second and the agent never notices. Intent means a tap on the phone, so every privilege escalation is a notification you see and approve. Authentication means a biometric on the phone. On one of our Macs, a coding agent runs sudo through PAM and the phone on the desk answers in about a quarter of a second. Walk out of the room and the same command fails, the Bluetooth link drops, and the screen locks behind you.

An agent runs sudo, ssh or git; the Allthenticate service relays the request over Bluetooth to the phone, which answers at the assurance level you chose.

The agent gets a shell. You keep the keys. That is the whole design.

What this looks like day to day

• Point the agent at a project directory, never at your home directory. With the key on the phone there is nothing in the home directory worth taking, but there is no reason to hand over your Downloads folder either.

• Set sudo to Intent on any machine where an agent works while you do something else. Each escalation becomes a tap you see, and a request you did not expect is one you decline.

• Sign every commit. The signature says a person was present, which is a useful thing to be able to prove about code an agent wrote.

• Let the lock follow you. An unattended laptop with an agent in a terminal is the scenario every incident above needed. Ours locks when the phone leaves.

We run coding agents all day at Allthenticate. They open merge requests, chase CI, and drafted this post. Every privileged action they take goes through a phone in someone’s pocket, and when the pocket leaves the building, the agent waits.

The takeaway: an agent is exactly as dangerous as the secrets it can reach. Put the key where the agent cannot go, and then let it work. Allthenticate is free to try at allthenticate.com/downloads.