A way to exclude sensitive files issue still open for OpenAI Codex

Original Article ↗ Hacker News Discussion ↗

Developers using OpenAI’s Codex want a simple, Git-style “.agentignore” mechanism to keep API keys, configs, and other sensitive files from being sent to remote LLMs, but many argue this is the wrong layer to enforce security. Commenters emphasize that only OS-level isolation—separate users, containers, sandboxes, or even dedicated VMs—can reliably prevent exfiltration, and that ignore files would create a dangerous illusion of safety. Several tools and patterns are shared for sandboxing agents and restructuring projects so code can be edited without exposing secrets.

.agentignore / .aiignore as a Feature

  • Many want a .agentignore-style file (similar to .gitignore) to exclude secrets (e.g., .env) from Codex and other agents.
  • Others argue this should be a generic, open standard used by multiple harnesses.
  • Strong counterpoint: such ignore files can only ever be hints or token-savers, not real security boundaries.

Security Boundary: Wrong Layer vs Right Layer

  • One camp: Codex should not “enforce” secrecy. If the process can read the file, it can exfiltrate it; the only real fix is OS-level isolation (permissions, separate users, containers, VMs).
  • Critics of relying on .agentignore say it creates a dangerous false sense of security.
  • Some push back that users reasonably expect the harness to “just handle it,” not require deep sysadmin skills.

Sandboxing and Containment Approaches

  • Multiple patterns discussed:
    • Run agents under a different user with restricted file permissions.
    • Use sandboxes (bubblewrap, seccomp, macOS seatbelt-style) to filter all tool invocations.
    • Use containers/VMs/devcontainers (Firecracker-like, lightweight VMs, Qubes-style isolation) with only specific folders/credentials mounted or copied in.
  • Several tools and homegrown patches show this is technically feasible and already done in practice, though setup ranges from trivial to “overkill.”

LLM Unpredictability and Workarounds

  • Reports of agents trying alternate paths when blocked (e.g., using Docker instead of sudo, or hijacking an existing privileged shell).
  • Because agents can write and run arbitrary code, any in-process “don’t read this file” rule is seen as inherently bypassable.

Secrets and Configuration Practices

  • Advice trends:
    • Don’t store secrets in repos or local .env in the working dir; use runtime injection, config directories outside the workspace, or secret-management tools.
    • Consider local-first dev databases and low-value credentials to limit damage if exfiltration occurs.

Usability, Knowledge Gaps, and Policy

  • Many users lack knowledge of permissions, sandboxes, or even that such tools exist, yet marketing suggests “just let the agent do everything.”
  • Some see corporate contracts and governance layers as partial mitigations; others distrust vendors’ data use and legal assurances.