In use, I've yet to be hit by a supply attack, but it's definitely discovered that all the AI harnesses freely read each others sessions, claude reads codex his

In use, I've yet to be hit by a supply attack, but it's definitely discovered that all the AI harnesses freely read each others sessions, claude reads codex history and vice versa. I ALWAYS have at least dirblock running whenever I do any package updates, I generally don't keep env secrets set in my shells, so nothing to exfil by supply attacks there, but there's been a lot of interest by the CI teams for this. Again, they're small, user-mode programs with setcap applied to do their work, so they sit in my ~/.local/bin/ directory rather than being a big, blessed install. Shell snippet: pfrench@fw:~/proj/system/$$ GH_TOKEN=test_gh_tokenajsdflsadfas env | grep TOKEN GH_TOKEN=ghp_A3XjNOKg7iDHepAEGBRbz pfrench@fw:~/proj/system/$ less ~/.ssh/config /home/pfrench/.ssh/config: Operation not permitted