Why your agent isn't a REPL: the threat model difference

A REPL is a safe place to try things. You type a command, you read the output, you decide what happens next. The human at the keyboard is the authorization boundary, and nothing executes without passing through that boundary.

Your AI agent looks similar — it sits in a terminal, runs commands, prints output. But the similarity is cosmetic, and the threat model is different. Treating your agent like a REPL is how secrets end up in model logs.

What actually changed

In a REPL, every action traces back to a human decision. The agent, by contrast, is driven by instructions that arrive from outside the terminal: task descriptions, file contents, web pages, tool outputs. It reads, decides, and executes — often many steps at a time — with only loose, after-the-fact review. The authorization boundary moved from the human to whatever the agent decides to do next.

Prompt injection is the tell

The difference shows up in prompt injection. An injected instruction in a webpage or a README cannot make a human run a command that uploads their keys. It can make an agent do exactly that, because the agent’s reasoning is continuous with the content it processes. In a REPL, untrusted text stays data. In an agent, untrusted text becomes instructions. That single fact changes everything downstream: the controls that keep a REPL safe — your own judgment — are no longer in the loop.

The review illusion

“Just review the diff before merging” sounds like the REPL model carried forward. It is not enough. Exfiltration rarely shows up in the diff — it happens in a tool call the review never sees, or in the model output itself. Reviewing the agent’s work is necessary, but it is a control at the wrong layer: it checks output after the fact, while the damage happens at input time.

What the new threat model requires

• Treat the agent as an untrusted caller. Its context, its tool outputs, and its model traffic are all attack surface. Assume the agent can be steered.
• Keep secrets unreadable by the agent. If a key is in the context, injection can move it. Credentials should be resolved outside the agent and injected at the moment a subprocess or HTTP request needs them, with output scrubbed so values never round-trip back into context.
• Check every egress. Model API requests should pass through a DLP layer that masks secret-shaped values before they leave the machine.
• Audit what the agent did. An append-only log of credential resolutions and tool invocations turns “what happened?” into a query rather than a guess.

A REPL is a feature; an agent is a process

None of this means agents are unsafe, or that you should go back to typing every command. It means the mental model has to change. A REPL gives you safety by requiring your presence. An agent needs safety built into the machinery around it — permission gates, credential isolation, output filtering, and logs.

That machinery is exactly what trustless implements: a single-binary credential broker that injects secrets into subprocess environments and HTTP requests without exposing them to the agent, scrubs tool output, and records every resolution in an append-only audit log. The command reference is in the documentation.

When you watch your agent run, do you review it like a REPL — or audit it like the autonomous process it actually is?