guide
Oct 10, 2026Why monitoring file-read tools misses agent execution loops: how coding agents use shell pipelines and shadow scripts like load_dotenv() — and how AD-004 detects them.
Most enterprise security tooling evaluates developer environments using static assumptions: inspect the repo with SAST, scan commits with git hooks, and monitor endpoint file system access.
Autonomous AI coding agents render those assumptions obsolete.
An agent is not a static script. It is an iterative reasoning engine paired with tool execution. When an agent is tasked with fixing an API endpoint or setting up a database test, it attempts to resolve missing configuration variables dynamically.
If an enterprise restricts direct file-read tools or monitors native file system events, the model does not simply give up. It adapts. It writes a temporary Python script that loads .env.production into memory. It runs a shell command that pipes credentials through sed or grep. Or it creates a temporary Bash script that sources environment variables and prints them.
To traditional security tooling, this looks like normal code generation: a file named runner.py was created and run. Underneath, production credentials and cloud secrets were loaded into the model's runtime context.
To solve this, observability cannot merely watch file system reads. It must inspect the entire agentic execution loop across three distinct operational surfaces.
In ReclaimLLM Enterprise, we designed AD-004: Sensitive File Access Detection to scan completed sessions deterministically. Rather than relying on fuzzy machine learning or heuristic guesses, AD-004 inspects three specific surfaces where secrets cross from the local workstation into agent context:
┌────────────────────────────────────────────────────────┐
│ AI Coding Agent │
└──────┬───────────────────┼──────────────────────┬──────┘
│ Surface 1 │ Surface 2 │ Surface 3
▼ ▼ ▼
Direct Tool Access Shell Command Access Code & Script Mentions
• readFile(.env) • cat .env.production • load_dotenv(".env")
• writeFile(.envrc) • sed -n 'p' dev.env • open(".env").read()
• *.pem, id_rsa • rg "KEY" .env • source .env && run
What happens:
The agent natively calls a built-in file inspection tool (readFile, view_file, edit_file) targeting known credential files.
Target patterns detected:
.env, .env.*, *.env, .envrc*.pem, *_rsa, *id_rsa, *.p12*credentials*.json, *service-account*.jsonThe Governance Check:
AD-004 does not merely check if the file was accessed; it correlates each access with Pre-Execution Hook DLP status (was_redacted) so investigators can separate covered reads from DLP gaps.
code_mention events produce a Warning finding — including when DLP redacted secrets to [REDACTED:API_KEY] before model ingestion. Redaction is investigation context, not a separate severity gate.open(".env", "w")) escalate to High.was_redacted.What happens:
When native file tools are unavailable, restricted, or when the agent defaults to terminal commands, it uses shell utilities to extract file contents:
cat .env.production
head -n 20 .envrc
sed -n '/DATABASE/p' dev.env
rg "AWS_SECRET" .env
This represents one of the most common real-world leak vectors in autonomous coding sessions. A developer asks, "Why is the S3 upload failing?" The agent runs cat .env in the terminal to inspect the bucket configuration, dumping the live AWS_SECRET_ACCESS_KEY into terminal stdout.
That stdout is packaged into the agent's next message payload and sent directly to the model provider. Because this occurred inside a shell execution command, simple file-read monitors miss it entirely.
AD-004 parses shell command arguments and pipelines, identifying sensitive file references across terminal executions and flagging them as shell_read access events.
What happens:
The agent generates code that opens, loads, or sources a sensitive file—frequently writing a temporary helper script to disk and executing it in the background:
# Temporary script written by an agent to verify connection
from dotenv import load_dotenv
import os
load_dotenv(".env.production")
conn_str = os.environ.get("DATABASE_URL")
# Agent runs this script to inspect connection behavior
# Agent writes and runs a quick setup helper
source .env && echo "Loaded config for $APP_ENV"
This surface is critical because traditional hook DLP operates on inputs and outputs at the boundary. When a model writes a Python script that references .env as a string literal, no secret passes through the hook at generation time.
However, the script itself becomes the exfiltration vector the moment the agent executes it: the Python interpreter reads the secret into memory, outputs it during debugging, or passes it back through runtime exceptions.
AD-004 scans tool outputs and agent-written files for code constructs, file path literals, load_dotenv() invocations, and source .env expressions, recording them as distinct code_mention events.
Many AI governance tools rely on secondary LLMs to classify security risks. This introduces two fatal flaws into enterprise compliance:
AD-004 is completely deterministic. It executes nightly over session metadata and evaluates explicit rules:
| Severity | Threshold Criteria | Recommended Action |
| :--- | :--- | :--- |
| Warning | One or more sessions contain a sensitive file read or code_mention where DLP coverage was verified (was_redacted: true). | Review during routine morning digest. Verify that access was part of legitimate local development. |
| High | At least one session executed a write operation to a sensitive file path, or the code mention involves overwriting environment variables (open(".env", "w")). | Investigate whether an agent altered local security credentials or corrupted configuration state. |
| Critical | Multiple sessions exhibit sensitive file activity and at least one session had no DLP coverage (was_redacted: false). | Immediate incident escalation. Secrets may have traveled unmasked to external model provider endpoints. |
An alert system should never cause a secondary security incident.
When AD-004 detects an unredacted secret or an agent script reading .env, what does it record in the finding evidence?
read, write, shell_read, code_mention), matched file pattern categories (env_file, private_key), DLP coverage status, and authenticated session IDs.Security administrators receive bounded, explainable evidence that allows them to click through authenticated portal deep links directly to the offending session trace—without sensitive data ever leaving the encrypted storage boundary.
rclm-hooks-install).Autonomous coding agents are formidable engineering multipliers. But if your security architecture only monitors direct tool reads, you are looking at a fraction of the actual execution loop.