The inventory

These are ordinary paths on most developer Macs, unremarkable to the tools that created them:

  • SSH keys: ~/.ssh/, often private keys with no passphrase, ready to sign in to every server and Git host they're registered with.
  • Cloud credentials: ~/.aws/credentials, plaintext access keys for an AWS account, often with far broader permissions than the task they were created for.
  • GitHub CLI tokens: ~/.config/gh/hosts.yml (or the keychain, depending on setup), enough to act as you on every repository you can reach.
  • Container registry logins: ~/.docker/config.json, for any private registry you've signed in to.
  • Package tokens: ~/.npmrc can hold an npm token with publish rights to your packages.
  • Shell history: ~/.zsh_history or ~/.bash_history, a plaintext log that often includes commands with credentials pasted into them.
  • Project secrets: .env files in whatever project the agent is working in, usually in .gitignore precisely because they aren't meant to leave the machine.
  • Browser data: session cookies and saved logins stored in the browser's profile folder, readable by anything with access to it.

A realistic scenario, no malice required

No attacker needed. You ask an agent to find out why a deploy script keeps failing. While investigating, it runs aws configure list to see which credentials are active, searches the project for anything mentioning the failing service (which turns up a .env file with a database password), and reads ~/.ssh/config to see how the deploy target is reached. None of that is wrong; a good engineer would look at the same things. The difference is that an engineer has judgment about a credential they stumble on. An agent's next step is whatever the model decides, and if that decision gets steered by something it shouldn't trust, a comment in a file or a line in a bug report, there's no human pause between reading the credential and using it.

Git and source code

Source code and Git (commits, hooks, and install chains that lead to hooks) deserve their own treatment: can you trust an AI coding agent with your Git repository?

Why this list and not a scarier one

Nothing above needs a compromised or jailbroken agent. It's what's reachable by design once an agent runs with the account's file access, which is the point of the mechanism post. The fix isn't a smarter agent that knows to avoid these files; it's running the agent where this list doesn't exist. In a fresh Linux workspace, ~/.ssh, ~/.aws and your browser profile simply aren't there, unless you deliberately share them in. VM vs. container vs. sandbox on macOS covers the options.

Related reading: how AI coding agents use your computer, what goes wrong when an agent runs unsandboxed, and running AI agents safely in an isolated VM. Or download Velo Workspaces and try it yourself.