right, but say you give the agent access to github and it can push as you, or make a gist; now it can easily exfiltrate your secret.

And that's just an easy case - really if it has any network access at all it can come up with a clever way to route a request through the network such that the key comes back somewhere in the request. If you scan for it inbound too, the machine can obfuscate it.

Our agents are trained to be so intensely helpful and they have such intricate knowledge of how things work that they will do some incredibly clever tricks to do what you ask them to do.

what's to stop an agent creating an outbound call with the var to a malicious endpoint? (unless you whitelist what it has access to)

or an outbound call to a trusted endpoint with the env var in a way that can get exposed to the agent via a subsequent call?