In use, I've yet to be hit by a supply attack, but it's definitely discovered that all the AI harnesses freely read each others sessions, claude reads codex history and vice versa.
I ALWAYS have at least dirblock running whenever I do any package updates, I generally don't keep env secrets set in my shells, so nothing to exfil by supply attacks there, but there's been a lot of interest by the CI teams for this.
Again, they're small, user-mode programs with setcap applied to do their work, so they sit in my ~/.local/bin/ directory rather than being a big, blessed install.
In use, I've yet to be hit by a supply attack, but it's definitely discovered that all the AI harnesses freely read each others sessions, claude reads codex history and vice versa.
I ALWAYS have at least dirblock running whenever I do any package updates, I generally don't keep env secrets set in my shells, so nothing to exfil by supply attacks there, but there's been a lot of interest by the CI teams for this.
Again, they're small, user-mode programs with setcap applied to do their work, so they sit in my ~/.local/bin/ directory rather than being a big, blessed install.
Shell snippet:
pfrench@fw:~/proj/system/$$ GH_TOKEN=test_gh_tokenajsdflsadfas env | grep TOKEN
GH_TOKEN=ghp_A3XjNOKg7iDHepAEGBRbz
pfrench@fw:~/proj/system/$ less ~/.ssh/config
/home/pfrench/.ssh/config: Operation not permitted