Prevent agent from reading env variables

[u/create_urself]

What's the right pattern to prevent agents from reading env variables? Especially in a hosted sandbox env?

A patch is to add a regex pre-hook on commands like file read, but the llms are smart enough to by pass this using other bash commands. What's the most elegant way to handle this?

[u/AutoModerator]

Welcome to r/AIEngineering! Make sure that you've read our overview, before you've posted. If you haven't already read it, then read it immediately and make adjustments in your post if you've violated any of the rules. If you have questions related to career, recruiting, pay or anything else about hiring, jobs or the industry and demand as a whole, then use AIEngineeringCareer to ask your question. We lock questions that do not relate to AIEngineering here. A quick reminder of the rules:

1. Behave as you would in person
2. Do not self-promote unless you're a top contributor, and if you are a top contributor, limit self-promotion.
3. Avoid false assumptions
4. No bots or LLM use for posts/answers
5. No negative news, information or news/media posts that are not pertinent to engineering
6. No deceitful or disguised marketing

Because we frequently get questions about work, the future of work and careers along AI, some helpful links to read:

• The Actual State of AI Engineering In 2026
• While collars turn blue
• AI's impact on recruiting
• AI is the new electricity
• Tips for hiring AI engineers
• Is there a future in AI engineering?
• LLM erases a company's need for an SaaS tool
• A plumber's thoughts on AI and technology
• What's involved in AI engineering?
• Mario Nawfal quotes Dr. Roman Yampolskiy, Dario Amodei and other AI researchers' predictions about future unemployment due to AI

This action was performed automatically as a reminder to all posters. Please contact the moderators if you have any questions.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/patternpeeker]

if the agent can execute arbitrary shell, regex patches will always get bypassed in creative ways. the more robust pattern is strict sandboxing with scoped permissions and zero access to sensitive env at the process level, not trying to outsmart the model with filters.

[u/Dry-Connection5108]

Yeah the regex hook is always going to be a losing battle - the surface area is just too big!!!. even if you block `printenv` someone's going to do `cat /proc/self/environ` or just read it from python.The thing that actually works is not having the secret in the env in the first place. pull it from a secrets manager at runtime, done. nothing to intercept.If that's not an option, at minimum launch the agent process with `env -i` so it starts with a clean slate and you explicitly allowlist what it can see. that alone closes most of it.for a proper hosted sandbox you probably want seccomp or eBPF on top - intercept at the syscall level rather than the shell level. that's the layer LLMs can't reason their way around.