Claude Code Can Read Your SSH Keys. Mine Can’t.

2026-07-25 · Source: AI on Medium · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Software Development & Engineering · Depth: Intermediate, quick

Summary

The article warns that AI coding agents like "Claude Code," when run directly on a host machine, inherit the user's full file system permissions, extending far beyond the immediate project directory. This means sensitive data such as SSH keys ("~/.ssh/id_ed25519"), AWS credentials ("~/.aws/credentials"), GitHub tokens ("~/.config/gh/hosts.yml"), npm tokens ("~/.npmrc"), and all ".env" files across cloned repositories become fully accessible. The author clarifies this access is a consequence of the agent running as the user, not due to malicious design. Beyond read access, the article notes the potential for agents to modify critical system files like shell configurations or git hooks, which could execute later without explicit user command. The recommended mitigation is to execute these agents within a dev container environment.

Key takeaway

For Software Engineers integrating AI coding agents into your workflow, you must prioritize environment isolation. Running agents like Claude Code directly on your host exposes all your sensitive files, including SSH keys and AWS credentials. Implement dev containers for every agent project to sandbox its access, limiting its reach strictly to the project folder. This proactive step prevents unintended data exposure and mitigates risks from potential agent modifications to your shell configuration or git hooks.

Key insights

AI coding agents running as a user gain full host access, posing significant security risks to sensitive credentials and system files.

Principles

• Agent access mirrors user permissions.
• Default execution exposes sensitive data.
• Write access enables future code changes.

Method

Execute AI coding agents within a dev container to isolate their file system access and prevent exposure of host-level sensitive credentials and system configurations.

In practice

• Configure dev containers for AI agents.
• Isolate SSH keys and AWS credentials.
• Protect ".env" files from agent access.

Topics

• AI Coding Agents
• Dev Containers
• Security Vulnerabilities
• Credential Management
• Environment Isolation

Best for: AI Engineer, MLOps Engineer, Software Engineer

Related on AIssential

• Your AI Agent Just Got Hacked, And You Didn’t Even Notice — AI agents are vulnerable to "innocent instruction" attacks via malicious skill files from public repositories, leading to silent data exfiltration.
• In the wake of Claude Code's source code leak, 5 actions enterprise security leaders should take now — The Claude Code source leak exposes critical AI agent architecture and highlights systemic operational security gaps in AI development.
• Building AI Agents in Rust - part 9 — Enabling AI agents to run arbitrary code requires deep, multi-layered sandboxing to balance power and security.
• Friendly Fire: Hijacking Defensive Cyber AI Agents for Remote Code Execution — Defensive AI agents can be hijacked for remote code execution when analyzing third-party libraries.
• Is your security team ready for AI coding agents? Join us on July 14🛡️ — The rise of autonomous AI coding agents necessitates a fundamental shift in enterprise security playbooks beyond traditional tools.
• the claude leak made one thing harder to ignore — Agent products are sophisticated control systems, with orchestration and explicit control layers being critical.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by AI on Medium.