In use, I've yet to be hit by a supply attack, but it's definitely discovered that all the AI harnesses freely read each others sessions, claude reads codex history and vice versa.

I ALWAYS have at least dirblock running whenever I do any package updates, I generally don't keep env secrets set in my shells, so nothing to exfil by supply attacks there, but there's been a lot of interest by the CI teams for this.

Again, they're small, user-mode programs with setcap applied to do their work, so they sit in my ~/.local/bin/ directory rather than being a big, blessed install.

Shell snippet:

pfrench@fw:~/proj/system/$$ GH_TOKEN=test_gh_tokenajsdflsadfas env | grep TOKEN

GH_TOKEN=ghp_A3XjNOKg7iDHepAEGBRbz

pfrench@fw:~/proj/system/$ less ~/.ssh/config

/home/pfrench/.ssh/config: Operation not permitted