# We let an AI agent execute Bash and lived to talk about it — Sarah Sanders, PostHog

Source: [AI Engineer](https://www.youtube.com/watch?v=4lXks428C9o)  
Feed7 permalink: https://feed7.dev/p/we-let-an-ai-agent-execute-bash-and-lived-to-talk-about--29474900b2  
Published: 2026-09-14T00:00:00.000Z  
Trust: Source Linked (source_linked)

## Why Included

For command-capable agents, deny Bash by default, keep secrets out of context, and scan both incoming context and generated output.

## Source Summary

PostHog treats every context source as part of an agent’s supply chain, scanning at build and use time while reserving blocking decisions for deterministic controls.

## Practical Implication

For any agent that can execute commands, make Bash deny by default, keep secrets outside model context, and scan both incoming context and generated output. Enforcement should remain deterministic; an LLM may triage noise only after mechanical rules have decided not to block.

## Agent-Ready Context

PostHog’s setup agent runs for about **8,000 users per week** and consumes docs, prompts and example apps as skill bundles. Its threat model includes poisoned first-party content, so inputs are scanned when skills are built and again when the agent uses them.

For any agent that can execute commands, make Bash **deny by default**, keep secrets outside model context, and scan both incoming context and generated output. Enforcement should remain deterministic; an LLM may triage noise only after mechanical rules have decided not to block.

PostHog reports almost no malicious prompt injection found in the wild and many false positives. Rule quality therefore depends on positive and negative tests, impact-based severity, telemetry and layered controls; no individual scanner or sandbox is sufficient.

## Context Map

- Layer: agent
- Domains: coding, security
- Topics: harness-engineering, sandboxing, agent-reliability

## Uncertainty

- None recorded.

## Agent Instruction

Use this item as source-backed context. Do not invent claims beyond the linked source. If this item conflicts with another source, call out the conflict.