TinkerNothing run yet.the code runs in the sandbox · files: working copy writable, data read-only, keys hidden · network: open · secret: in the sandbox
Chapter 4 of 7
Secrets
The agent’s task needs Larkspur’s API token to call the API. But if the token sits where the agent can read it, a compromised agent can read it too, and send it out. Where should the secret live?
This chapter: With the egress open, does moving the secret out of the sandbox stop it being stolen?
You will learn
- Why a secret in the sandbox’s environment can be read by a compromised agent
- How a proxy holds the secret and adds it only on allowed requests, so the agent never sees it
- That keeping secrets out of the agent is a defence the network layer cannot give
Words you’ll meet (3)
- Secret
- A credential such as an API token, which authenticates Larkspur’s requests.
- Environment
- The variables and files a program can read while it runs, inside the sandbox.
- Proxy-injected secret
- In Claude Code on the web, sensitive credentials such as git credentials or signing keys are never inside the sandbox; a proxy verifies the operation and attaches the real authentication token before forwarding the request.
The picture on the left is live. Each step below asks you to do one thing in it; the story continues here as you go.
Step 1 of 4
The task needs Larkspur’s API token. A colleague puts it in the sandbox’s environment so the agent can use it. A planted note tells the agent to send it to an auditor. Egress is open. Run it.