AI Coding Agent Security: Secrets in the Room | Elacity
A hidden GitHub issue comment could hijack a coding agent and read every secret in its environment. AI coding agent security starts by keeping secrets out of the agent's room.
AI Coding Agent Security: The Secret Was Already in the Room
If your team lets an AI agent pick up issues and open pull requests, a stranger can now leave that agent instructions you will never see. AI coding agent security breaks at a simple place: the agent reads text anyone can write, in a room where your secrets are already sitting.
On October 21, BeyondTrust's Phantom Labs published research showing that one hidden comment on a GitHub issue could hijack the Copilot coding agent. The comment looks harmless to the maintainer who assigns the issue. The agent reads the part the maintainer cannot see, and does what it says.
The Failure of Secrets That Live Where the Agent Works
The researchers describe a full chain: steal the agent's token, push code to its branches, and read every agent secret configured for the repository or the organization. Where the agent's setup file granted extra permissions, they escalated into CI/CD pipelines and connected cloud accounts.
The step that matters most is also the plainest. In the runner, agent secrets were stored in process environment variables, so one command that dumped the environment handed them over. No cryptography was broken. The secret was simply in the room when the attacker's words arrived.
GitHub does defend the front door. Its documentation says it filters hidden characters such as HTML comments before input reaches the agent. The researchers report they found agent-specific markup that still reached it, and that GitHub classified the findings as informational, reasoning that a human with write access chose to assign the issue.
That reasoning is worth taking seriously, because it describes the real problem. The maintainer approved a task. Nobody approved handing every secret in the environment to whoever wrote the issue.
This is not one vendor's bug. In April, researchers showed that AI review agents from three major providers could be steered into leaking credentials back through GitHub itself. In the first half of October, Flowise, Langflow and PraisonAI each fixed flaws where injected text led to code execution, one of them running generated code with the full parent-process environment. Salt Labs showed an agent platform hijacked by a single email, with its own guardrail firing only after the code had already run.
Security guidance has drawn the conclusion. OWASP now tells teams to assume anything in the agent's process environment can be read and sent out by an injected instruction. Microsoft's researchers propose a rule of two: never let one workflow hold untrusted input, access to secrets, and the ability to act externally at the same time.
The Elacity Solution: Authority the Agent Can Use, Never Hold
Elacity is building the ownership layer for the digital economy, where your data, work and IP become Wealth Capsules that humans and AI agents pay to use. An ownership layer is only as good as the place its keys live. Beneath it runs ElastOS, the open runtime Elacity builds as MIT-licensed infrastructure for the Elastos DAO, and its answer to this week's research is to take the secret out of the room.
1. Zero Ambient Authority
A process on ElastOS starts with nothing: no files, no network, no money, no environment full of tokens. It receives a narrow, signed, expiring capability for one job, and revoking it stops the action mid-flight. This is capabilities, not access control lists, as our capability-based security explainer sets out. An injected instruction can only reach what that one grant covers.
2. Keys Are Used, Never Owned
When a task needs to sign or decrypt, the secret exists in the clear only for a split second inside a sealed sandbox, welded to that one operation, then wiped. There is no variable to dump and no file to copy. We argued in why credential theft keeps winning that a key sitting still is a key waiting to be taken; this is the same rule applied to an agent that reads strangers' text all day.
3. The Network Is Not the App's to Choose
ElastOS is designed to hide the internet from apps. An app gets no sockets or addresses of its own, so a hijacked task cannot quietly open a channel to wherever an attacker points it. Every crossing out of the owner's space needs the owner's signed permission.
The design goal is the rule of two by construction rather than by configuration. The agent can still read untrusted text. It never holds a secret worth stealing, and it cannot ship one out on its own.
What Is Still Being Built
Honesty about edges matters more in security than anywhere else. The primitives above, keys used never owned and narrow, revocable, fail-closed capabilities, exist today. The agent product around them, including agent wallets and an autonomous approval and kill loop, is in development. ElastOS also runs fullest on Linux today, with Mac and Windows parity still to come.
Humans and AI agents pass through the same capability model on ElastOS. That is deliberate: the safest agent is not a smarter one, it is one that was never handed the keys.
Prompt injection will keep finding new hiding places. The fix that lasts is a computer where a successful injection has nothing to take. More in our Trust & Safety Protocol coverage.
Get ElastOS and run your agents on a computer you own.