A subagent got a simple task: read a project's docs and say how to run it. It read docs/readme.txt , found "make run", and then asked for one more file: ~/.ssh/id_rsa .

Why it asked doesn't matter. A hidden instruction in something it read, a buggy third-party tool, a model that "thought" the key would help. What matters is what happens next, and in most setups today the file is read. Not because anyone granted the subagent access to the key, but because nobody granted anything to anyone: the tool runs as your user, and your user can read your key.

There's an old name for this: ambient authority . The kernel doesn't know about agents. It sees user ana and processes of ana .…