# Agent shell tools leak secrets

Agent-reachable shell/process tools reading env, /proc memory, or argv-injected file reads

_Area: AI and LLM app security. Seen in 2 disclosed reports; latest 2026-09-18. Updated 2026-10-23._

## How it works
Agent tools that execute commands or spawn processes inherit the privileges and environment of the host runtime. The broken assumption is that the tool boundary equals a security boundary: if the tool runs under the same UID, process namespace, or environment as the component holding secrets, the model can reach those secrets through ordinary command output. Secrets resolved in-process (vault tokens, API keys, cloud credentials) sit in memory or env and become readable to any execution primitive the agent can invoke [E1](https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-securing-aws-agentcore-harness-credentials.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-h539-c7r8-3xq4.md).

## Where it shows up
- Shell/exec tools running as root or as the same UID as the secret-resolving runtime (PID 1) [E1](https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-securing-aws-agentcore-harness-credentials.md)
- Child processes spawned without `env_clear()` or the project's env-scrubber helper [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-h539-c7r8-3xq4.md)
- Model-supplied arguments concatenated into argv without `--end-of-options` or leading-dash rejection [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-c6mw-8xh8-gpq6.md)[E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-7j5w-7r7x-9v27.md)
- Tools marked Auto-approval or ReadOnly that still reach file-read/write flags (`--contents`, `--output`) [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-c6mw-8xh8-gpq6.md)[E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-7j5w-7r7x-9v27.md)
- New spawn sites added after a centralized hardening helper exists [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-h539-c7r8-3xq4.md)

## How to review
For each agent-reachable execution primitive, establish the invariant: the tool must not share UID, process namespace, or environment with any component that holds plaintext secrets. Check that spawned children get an explicit scrubbed environment, and that every model-controlled argv element is separated by `--end-of-options` and rejects leading hyphens. Audit each argv position separately; a `--` before the pathspec does not protect earlier positional args [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-c6mw-8xh8-gpq6.md). Diff every spawn/call site against the centralized helper [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-h539-c7r8-3xq4.md).

## Variants seen
- Same-process memory read: root shell tool reads `/proc/1/mem` to recover vault JWTs [E1](https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-securing-aws-agentcore-harness-credentials.md)
- Environment inheritance: Node child without env scrub leaks `process.env` into transcript [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-h539-c7r8-3xq4.md)
- Argument injection for file read: `git blame --contents=` bypasses workspace boundary [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-c6mw-8xh8-gpq6.md)
- Argument injection for file write: `git show --output=` overwrites files despite ReadOnly label [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-7j5w-7r7x-9v27.md)

## Why fixes fail
A centralized env scrubber existed but new tools added afterward skipped it, so the hardening did not cover later spawn sites [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-h539-c7r8-3xq4.md). ReadOnly/Auto-approval labels gave false assurance while the underlying subcommand still accepted write flags [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-7j5w-7r7x-9v27.md).

## Impact and severity
Plaintext credentials and arbitrary host file read/write reachable via prompt injection, high severity. Worse when tools are auto-approved, run as root, or share the secret-holding process, removing approval and isolation barriers [E1](https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-securing-aws-agentcore-harness-credentials.md)[E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-7j5w-7r7x-9v27.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-securing-aws-agentcore-harness-credentials.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-c6mw-8xh8-gpq6.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-h539-c7r8-3xq4.md
- E4: https://bugbountylibrary.com/r/ghsa%3AGHSA-7j5w-7r7x-9v27.md