Airgap secrets from AI agents using mount namespaces

The 2,117 verified active credentials found in Model Context Protocol files prove that AI agent isolation is no longer optional. Airgap solves this by executing untrusted code within a mount namespace to enforce real-time secret redaction before data ever reaches the agent. This architectural shift moves security from reactive scanning to proactive invisibility, rendering stolen tokens useless even if the AI workflow is compromised.

Current secret management strategies fail because they assume the host environment is trustworthy, a fatal flaw when AI agents routinely access broad file systems. Unlike traditional vaults that merely store credentials, Airgap acts as a transparent wrapper, intercepting file read operations and stripping sensitive patterns on the fly. This approach directly addresses the surge in supply chain attacks where malicious packages execute during installation, a vector GitGuardian ties to 29 million new hardcoded secrets in public GitHub commits last year.

The trade is explicit. A FUSE layer in the read path costs I/O latency on every file operation, and redaction patterns have to be maintained as the codebase grows. What it buys is that an install hook, an agent, or any child process gets a sanitized view of the same file, so a token that leaks has nothing left to leak.

Why Valid Credentials in MCP Files Are the Attack Surface

Model Context Protocol files currently harbor 2,117 verified active credentials that bypass traditional perimeter defenses. This persistence creates a static attack surface where 70% of secrets exposed in 2022 remained valid through January 2025, rendering rotation policies ineffective against dormant leaks. A 34% year-over-year increase in secret leaks indicates that standard scanning tools fail to detect context-aware exfiltration attempts by autonomous agents.

AI agents parse configuration scopes differently than humans. Unlike human developers, agents strictly follow instruction chains without implicit trust boundaries, meaning a single compromised MCP file grants system-wide access. Superagent SDK attempts to block such injections via code integration, yet this approach cannot prevent initial credential ingestion if the file is already readable. Software-based redaction often occurs after the agent has already indexed the sensitive token, a clear limitation.

Operational reality demands a shift from detection to isolation. When an agent reads a file containing a long-lived API key, the damage window closes only when the namespace blocks the read entirely. Credential-management tooling such as Kirin enforces permissions at the IDE level, but the constraint remains the complexity of managing granular policies across diverse development environments. Without strict mount namespace virtualization, any valid credential found in an MCP configuration acts as an open door for automated theft.

Inside the Mechanics of Mount Namespace Isolation and Secret Redaction

Mount Namespace Isolation Mechanics in Airgap

Airgap spawns target processes inside a dedicated mount namespace, intercepting file reads via a FUSE handler to redact secrets before an agent sees them. This mechanism creates a virtualized filesystem view where sensitive tokens are stripped dynamically, contrasting with proxy-based tools that rely on MITM techniques to manage credentials. The architecture ensures that even if a malicious npm hook executes, it encounters only sanitized file contents within its isolated scope.

Performance penalties emerge when applications require direct hardware access or specific kernel capabilities that FUSE cannot virtualize efficiently. Unlike network proxies, this filesystem-level wrapper introduces latency during high-frequency file operations, potentially slowing build times for large dependency trees. Isolation fails if the target process escapes the user namespace, though such exploits remain rare in standard development workflows. Operators must weigh the security gain of preventing static secret exfiltration against the operational cost of added I/O overhead. The practical value lies in stopping accidental leaks rather than defending against determined kernel-level adversaries. Future deployments should monitor file access patterns to detect when legitimate tools conflict with redaction rules.

Integrating Airgap with npm Install Hooks

Mounting the project directory via FUSE before executing npm install forces every install hook to read redacted file views rather than raw secrets. This mechanism intercepts filesystem calls at the kernel level, ensuring that arbitrary code executed by a malicious package encounters sanitized tokens instead of valid credentials. A single compromised dependency can compromise an entire system, yet standard isolation often fails to restrict child process read access. Attackers target the install volume, with 73% of indexed malicious packages carrying pinned versions to evade detection.

The TrapDoor campaign demonstrated this risk by deploying malicious packages to steal SSH credentials directly from developer environments. Unlike proxy-based tools relying on MITM techniques, this approach prevents the agent from ever seeing the secret, eliminating the exfiltration path entirely.

Wrapping every package manager invocation adds latency to the build pipeline. The constraint is absolute prevention of install-time theft versus minor workflow friction. Gartner projects that 40% of enterprise applications will embed task-specific AI agents by 2027, expanding the attack surface for such hooks. AI Agents News recommends wrapping all CI/CD nodes where third-party dependencies are fetched to mitigate this escalating threat. This blind ingestion transforms static repository leaks into active compromises when agents execute arbitrary code during routine package installations.

Comparing Airgap Isolation to Traditional Secret Management Strategies

Filesystem-Level Isolation vs Proxy-Based MITM Techniques

Airgap enforces isolation via mount namespaces rather than the application-layer interception typical of proxy tools. This architectural divergence moves the security boundary from the network stack to the kernel, fundamentally changing how agents access data. Instead of redirecting traffic through a Man-in-the-Middle proxy, the system spawns target processes in a dedicated user space where the home directory appears as a virtualized view. Every file read operation passes through a FUSE handler that redacts secrets dynamically before the requesting process receives the data stream.

Critics argue that proxy approaches offer more elegance for managing LLM credentials, yet they fail to block non-networked exfiltration paths like local file scraping. The limitation of namespace isolation is the requirement for specific OS privileges, whereas proxies run in user space with fewer permissions. However, the consequence of relying solely on proxies is visible when agents delete production databases after finding tokens in unrelated config files, an incident pattern observed in April 2026. A mount namespace prevents this by ensuring the agent never sees the raw token string on disk. Operators must choose between the broader visibility of filesystem control and the easier deployment of network proxies. AI Agents News recommends namespace-based isolation for high-risk environments where local file access poses the greatest threat surface.

Why Vaults Do Not Stop an Agent That Can Read the File

Reactive credential storage fails against AI agents because account-scoped tokens lack environment boundaries, allowing a single context breach to delete production data. The April 2026 Railway production database deletion occurred when an agent bridged staging and production using one long-lived API token found in an unrelated file. This incident highlights how static secrets persist across contexts, enabling lateral movement that mount namespace isolation prevents by design. Traditional vaults store credentials but do not restrict how an authenticated agent uses them once retrieved.

Operators relying solely on vaults face a critical tension: granting agents sufficient access to function often means exposing the very secrets they need to protect. Filesystem-level redaction stops this by ensuring the agent never sees the raw secret, whereas reactive models assume the agent will not misuse what it can read. AI Agents News recommends shifting focus from storing secrets to limiting their visibility at the kernel level.

Implementing Airgap to Secure Your NPM Install Process

Wrapping the Shell, the IDE, and npm in One Namespace

Block malicious npm install hooks by spawning the package manager, and the shell or IDE that launches it, inside a mount namespace where the home directory is virtualized.

1. Install the airgap binary from the official repository and initialize the isolated environment with it to create a fresh user space.
2. Define redaction rules in the configuration file to mask specific secret patterns before any process reads them.
3. Launch the development environment through the wrapper and execute npm install inside it, so the FUSE filesystem intercepts and filters file access attempts dynamically.

The filesystem layer blocks these hooks from reading real credentials even when their code executes successfully. Critics note the proxy approach handles network traffic better, yet it fails against local disk reads during install hooks. Operators must accept a slight performance overhead during file I/O operations as the cost for kernel-level enforcement. AI Agents News recommends this isolation strategy for any workflow integrating automated coding agents. The limitation is strict local control versus broader network visibility. Unredacted credentials in development allow lateral movement if an agent escapes its sandbox.

Verification is the step teams skip: run the agent inside the wrapper and confirm it reads a redacted view of the files that hold the keys, before any untrusted code executes.