Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

How Do I Give a Sandboxed Agent Repository Files Without the Token That Fetched Them?

Put the token in an adapter outside the sandbox: it fetches one repository and copies a snapshot of the files into the workspace, so the agent reads them without holding the credential. Check where the token lives, what the snapshot includes, and whether the workspace can reach the network at all.

A credential reference travels from a browser record through a bounded route to a separate API destination.

For platform teams running agents in sandboxes, a repository fetch is a credential event before it is a file event. The token that opens the repository is the thing worth stealing, and the files are what the agent needs to do the work, so the clean arrangement separates them: one component holds the credential and retrieves the tree, another holds the files and runs the agent. The agent receives a working copy and no way to authenticate to the remote. That is the shape this page describes, and it is a how-to rather than a product setting, because the pieces are ordinary: a fine-grained token, an adapter process, a sandbox with a copied tree and no egress.

What decides the exposure is what the agent holds when the reading is done. A clone made inside the sandbox leaves the credential where the agent can reach it. A fetch made outside and copied in leaves the agent with files, an empty credential slot and no network path to the service. Firecracker, GitHub and Anthropic each document one piece of that arrangement, and the files themselves can still carry exposure once the token is out, so the boundary has to be set before the fetch and checked with a test afterward. The example is one record type: a working tree in a sandboxed workspace with the token in an adapter.

Key findings

  • Wiz examined 50 AI companies and reported that "65% had leaked verified secrets on GitHub" (Wiz, 2025).
  • GitGuardian's 2026 report counted "About 29 million secrets leaked on public GitHub in 2025," with AI-service credential leaks up 81% year over year (GitGuardian, 2026).
  • GitHub's token documentation says "Treat your access tokens like passwords" and describes fine-grained tokens "limited to only access specific repositories" (GitHub, Managing, 2026).
  • "Firecracker is designed to assure secure isolation using multiple layers," and the same design page says guest egress "should be filtered at the host-level" (Firecracker, Design, 2026).
  • Anthropic's Claude Code documentation states that for its cloud sessions "GitHub credentials are stored encrypted on Anthropic's servers and never enter the session VM," with the VM holding a short-lived credential scoped to that session (Anthropic, 2026).
  • A governed environment substitutes a consistent token for a value before any model reads a screen, so a settings page renders REPO_001 rather than the string. Real values resolve only at the approved destination at the moment of an approved action, not in the transcript (What Is Least Exposure?).

What does a sandbox boundary cover, and what does it leave out?

The title asks for files in a sandbox, and the first distinction is between the sandbox and the browser control that surrounds an agent's other work. A governed browser environment governs the rendered page an agent reads and works on: dashboards, consoles, settings pages and sign-up forms. It does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP. A sandbox sits in the excluded list, because it governs the processes and files an agent may touch once work begins, not the values a service draws on a screen.

The fetch is a direct API call made by a component outside the sandbox, so the sandbox boundary does not govern the request and a page-level control does not see it. The files are local after the copy, so the sandbox governs what the agent can do with them and the page control is silent.

The sandbox has a documented shape. Firecracker's design page says it is "designed to assure secure isolation using multiple layers," and it treats all egress as untrusted, to be filtered at the host (Firecracker, Design, 2026). For this page's record that means the workspace is isolated, it has no route to the repository service, and its tree came from a copy rather than a clone that can fetch again. What Is Least Exposure? draws the limit: least privilege governs actions and credentials, not the content of the screen an agent reads, so an agent can satisfy it in full and still hold every record it was shown.

The example is one working tree in a sandboxed workspace, with the token held by an adapter on the other side of the boundary.

How does the adapter fetch the files without handing over the token?

The exchange has three parts. A credential store holds a fine-grained token for one repository with contents read. An adapter outside the sandbox receives a request naming a repository, a commit and a path, and makes the fetch. The token never crosses into the process that runs the agent.

GitHub says to "Treat your access tokens like passwords" and offers fine-grained tokens "limited to only access specific repositories" (GitHub, Managing, 2026). The same page says "You should choose the minimal permissions necessary for your needs," which for a fetch means contents read, one repository and an expiry. Is It Safe to Let an AI Agent Set Up Your Cloud Environment? supplies the cloud-side rule: AWS strongly recommends against root access keys.

The request should name a commit, not a branch, because a branch moves. GitHub's secure use reference makes the point for workflow dependencies: "Pin references to actions to a commit SHA in your workflow files" (GitHub, Secure, 2026). The adapter fetches the archive for one commit, records the SHA and copies that.

The copy ends the agent's relationship with the credential. The adapter writes the files into the workspace and leaves no remote that can authenticate, so the agent can read, edit and run tests on a tree it cannot fetch again. What Is a Tethered Agent? describes the boundary as authority rather than capability.

What do the vendors themselves say?

Firecracker documents the sandbox. Its design page states that it is "designed to assure secure isolation using multiple layers" and that "All egress traffic from a guest is therefore considered untrusted, and should be filtered at the host-level" (Firecracker, Design, 2026). The jailer page adds process controls, including a new PID namespace and dropping privileges "via setting the provided uid and gid" (Firecracker, Jailer, 2026).

GitHub documents the credential. Its token page says "Treat your access tokens like passwords" and offers fine-grained tokens "limited to only access specific repositories" (GitHub, Managing, 2026). Its secure use reference says "It's good security practice to set the default permission for the GITHUB_TOKEN to read access only for repository contents" and asks teams to "Audit how secrets are used" (GitHub, Secure, 2026).

Anthropic documents one custody arrangement. Its Claude Code page states that "GitHub credentials are stored encrypted on Anthropic's servers and never enter the session VM" and that the VM holds "a short-lived credential scoped to that session" (Anthropic, 2026). The custody covers cloud sessions, not local ones.

Dimension What the documentation states What a buyer should verify
Sandbox isolation Firecracker describes layered isolation and host-filtered guest egress Whether the workspace has any route to the repository service
Workspace contents The sandbox pages describe processes, not what files arrive What the copied tree includes, and whether a remote remains
Credential scope GitHub documents repository-limited fine-grained tokens and read-only default permissions The repository, permission and lifetime the fetch grant names
Credential custody Anthropic keeps GitHub credentials off the session VM for cloud sessions Whether the same custody holds for local sessions and other vendors
File operations The Firecracker pages describe processes, not file approvals Whether a file write is gated by anything stronger than a prompt
Record GitHub asks teams to audit how credentials are used A per-run record of the fetch, the commit and the approving person

Read together, the pages answer the shape and leave one gap. A sandbox can be isolated and still receive a tree full of credentials, and a token can be scoped and still live in the process that runs the agent.

What can the agent do with the files once the token is gone?

A working tree copies everything committed, and SecretBench counts "97,479 secrets (of which 15,084 are true secrets)" in a labeled dataset of source code (Basak et al., 2023).

A README, a test or an issue can contain a line addressed to the model. LlamaFirewall's authors describe "PromptGuard 2, a universal jailbreak detector" and report that it "shows stronger efficacy at preventing indirect injections in general scenarios than previously proposed approaches" (Chennabasappa et al., 2025); a detector filters the way in, and passing files still reach the model. How Do AI Agents Bypass Company Data Protection Rules? names the combination that turns a read into a loss: private data, untrusted content and a way to communicate out.

The grant limits what the agent can do, not what it can read. Progent's privilege control "significantly reduces attack success rates while maintaining high utility" (Shi et al., 2026). According to the account in How Do You Give AI Agents Access to Workflows Without Exposing Sensitive Data?, OWASP's LLM06 entry treats excessive agency as more access than the task requires. The account of API-key custody in How Do You Let an AI Agent Manage API Keys Without Reading Them? counts "28,649,024 new secrets exposed in public GitHub commits across 2025."

How do you test that the fetch token stayed outside the workspace?

Test with one agent, one repository and one token created for the test. Give it contents read on that repository and an expiry shorter than the longest run. GitHub's token page notes that classic tokens are "less secure" than fine-grained ones and that an organization can impose a maximum lifetime (GitHub, Managing, 2026).

Run the fetch and look for the string in four places: the workspace, the transcript and tool output, the environment the agent's processes inherit, and the tree's remotes. A copy with a credential in its metadata is a clone in disguise. If the token appears in any of them, the boundary is scope rather than custody.

The fifth check is the network. From inside the workspace, request the repository host. It should fail at the host filter; Firecracker treats guest egress as untrusted (Firecracker, Design, 2026).

Then revoke the token and run the task again. The adapter should fail closed. The same discipline applies to the approver: Does an AI Agent Need Your Admin Login to Set Up a SaaS Tool? records Google's guidance to use a super admin account only when needed, and How Do You Restrict an AI Agent to One Workflow With Microsoft Entra, ServiceNow AI Passport or SailPoint? records Microsoft's statement that agent identities are created with limited permissions.

What does a governed environment change?

A governed environment is a control class that acts before a model reads a rendered page. Values chosen by policy are replaced with consistent tokens for the whole run, so a repository settings page that draws a token renders REPO_001, a deploy key renders DEPLOY_KEY_001, and the model works with those placeholders. Real values resolve only at the approved destination at the moment of an approved action. A named person confirms the tokenization policy and approves each consequential action, including the fetch grant that lets files into a workspace. Every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.

For this page's question the class changes the screen around the fetch, not the fetch itself. The adapter still holds the credential, makes the request and copies the tree. What changes is the page where a person reviews the token's scope and the page where a deploy key or a webhook secret would otherwise be drawn: those pages reach the model as tokens, and the approval to place the files is a named decision rather than a step inferred from a log. The record joins the page the model read, the grant it approved and the commit that was copied.

The class stops at the rendered page, and does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP. A file tree inside a sandbox and the fetch that produced it sit outside it, so the adapter and the sandbox configuration remain the mechanisms for that half. The governed environment governs what the model reads while it works and what the organization can prove afterward. Two controls, one run: the boundary keeps the token out, and the render layer keeps the model from reading a value it does not need.

Methodology and limitations

This page rests on three research preprints, on vendor documentation from Firecracker, GitHub and Anthropic, on a vendor exposure report from Wiz, on one industry press release from GitGuardian as carried by CIO Dive, and on existing RedactSure research pages. Vendor pages were read as of October 20, 2026, and each Sources line carries the date for its page. Quoted facts are cited to the page that states them, and figures from vendor research are cited as reported, not as independently measured. Wiz does not say how many of the 50 companies lacked a GitHub presence, and the SecretBench abstract attributes its two-fold 2021 figure to GitGuardian monitoring rather than to its own measurement. The adapter and the copy it makes are described as a design pattern assembled from those pages, not as a feature documented by any one vendor.

RedactSure did not test any named product hands-on. Where a page does not describe a mechanism, "not described in the pages reviewed" means the recorded facts for that page and nothing broader, and the Firecracker pages say nothing about credentials inside a guest. Vendor features change and the page carries its date, so a release after October 20, 2026 is unreviewed until the test in the previous section is repeated. Statements about RedactSure describe its current design, and RedactSure is deploying now with enterprise and government customers. The example describes a record type, a working tree in a sandboxed workspace with the token in an adapter outside it, and not an organization.

Determinations about whether a token, a sandbox configuration or an agent's access meets a contractual, regulatory or internal-control requirement belong to counsel, auditors and the organization's own security and compliance officers. Nothing here replaces a run of the organization's own agent against a test repository with a token that can be revoked.

What the record shows

For a security lead approving sandboxed agents, the evidence points one way. GitHub documents repository-limited tokens, Firecracker documents isolation and host-filtered egress, and Anthropic documents keeping GitHub credentials off the session VM; the research record shows why the tree itself remains the exposure after the credential is gone. Read together, they support a narrow conclusion: the token belongs to a component outside the sandbox, the tree belongs inside, and the approval belongs to a person with a name. The arrangement does not make the tree safe, because a copied repository can carry a committed credential or an instruction addressed to the model. That is the half a render-layer control governs, and RedactSure's environment is built on it. Whether the token stayed out is a test any team can run: name one agent, one repository and one token, run the fetch through an adapter, and ask which component held the string and what the model received on the page that showed it.

Frequently asked questions

Can a sandboxed agent get repository files without the token that fetched them?

Yes, if a component outside the sandbox makes the fetch. The adapter holds a fine-grained token, requests one commit, and copies the tree into the workspace. The agent then reads and edits files it can authenticate for nothing. The limit is what the copy contains: a repository can carry committed credentials or text written to steer a model, and neither is removed by the token's absence. Decide what the workspace may hold, not only who holds the token. Inspect the copy rather than the clone.

Where should the fetch token live?

In a store the adapter reads and the agent cannot, ideally scoped to one repository with contents read and an expiry that matches the run. GitHub documents fine-grained tokens limited to specific repositories and asks for the minimal permissions a task needs. A token in the sandbox environment, in a file the agent can open, or in a prompt is a string in the model's context and in every later step. A short expiry limits the window after the run. Rotation is the backstop, not the control for the run.

Does a clone inside the sandbox expose the token?

A clone made inside the sandbox normally leaves the credential in the place the agent can reach, because the process that fetched also runs the agent. Even a clone made with a helper can leave a remote that fetches again. The safer shape is a fetch outside and a copy inside, with no remote that can authenticate. Check the tree's metadata as well as its files, since a working copy can carry the means to repeat the request.

What should the copied tree leave behind?

The remote and anything that can authenticate. A snapshot of one commit, copied in without a credential-bearing remote and without a token in the environment, gives the agent a tree it can work on and nothing it can use to fetch again. Also check the branch and commit: a copy of a moving branch is not the tree a reviewer approved. A fresh copy per run is easier to audit: keep its origin and record the SHA beside the run.

Does revoking the token after the fetch fix the exposure?

Revocation limits the future, not the run. A token revoked after the fetch can no longer be used, but a string that reached the transcript, the summary or a file the agent wrote is already out, and the copied tree still holds whatever credentials it carried. Revoke as soon as the fetch ends, then search the workspace and the transcript for the value. Name the revocation time in the record beside the fetch. If either holds it, treat the token as compromised and rotate it.

What should a team ask a vendor in writing?

Where the token lives, which repository and permission it covers, and how long it lasts. Whether the sandbox can reach the repository host at all. What the copy includes and whether a remote remains. Who approves the fetch and the placement of the files. And what record shows the token page as the model saw it, beside the commit that was copied. Keep the answers beside the run that confirmed them.

About the author

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

How RedactSure Keeps the Fetch Token Out of the Sandbox

The adapter settles how files reach the sandbox, while the token pages are still drawn for the model and the approval is usually a log line.

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Before: the agent opens the repository settings page, and the page draws the token and a deploy key in the clear. Inside: the page renders REPO_TOKEN_001 and DEPLOY_KEY_001, the adapter holds the values and makes the fetch, and a named person approves the copied commit.

RedactSure is deploying now with enterprise and government customers. Wiz found that "65% had leaked verified secrets on GitHub."

Everyone else controls where data can go. RedactSure controls what the AI can see.

See it on your own workflow

The token that fetched the files is the one most likely to follow them into the sandbox. Bring a repository task and see, with test values, what the model reads on the settings page. Book a demo

Book a demo

Book a demo

Having trouble? Open the booking page or email us.