Your coding agent can read your .env file, your SSH keys, and your AWS credentials — and it will, without asking. Airgap is a new tool from Sven Sauleau that uses Linux namespaces to hide sensitive files from any program running inside it, including AI agents and npm install.
The approach is simple: airgap wraps a process in a namespace where specified files and directories are invisible. No secrets manager integration, no agent-level permissions, no trust required.
What it blocks:
- Secret files —
.env,.npmrc, SSH keys, cloud credential files are hidden from the wrapped process’s filesystem view - Network exfiltration — namespace isolation can restrict outbound network access, so even if a malicious npm package runs a postinstall script, it can’t phone home
- Hallucinated packages — an AI agent that installs a non-existent or typosquatted npm package still can’t reach your secrets, because they don’t exist inside the namespace
The threat model is real. Bitwarden’s engineering blog documented how Claude Code and Cursor will find and read .env files unprompted — not through prompt injection, just normal operation. A Hacker News thread from April 2025 showed developers struggling with the same problem: agents with shell access can run env or echo $API_KEY and grab whatever’s in scope.
Airgap sidesteps the whole permissions debate. Instead of configuring what an agent should do, it changes what the agent can see. The secrets aren’t redacted or encrypted — they’re absent from the mount namespace entirely.
NOTE
Airgap relies on Linux namespaces (unshare), so it’s Linux-only. macOS and Windows developers would need a Linux VM or container to use it.
The tradeoff is obvious: any legitimate process that needs those secrets also can’t reach them inside the namespace. You’d run your agent or build step through airgap, then run your actual application outside it. For the specific case of AI agents writing code and running npm install, that split maps cleanly to how most developers already work.