AI agents and package managers share a problem: they both run untrusted code with filesystem access. An agent reading your project directory can leak .env files to a model provider. An npm package with a preinstall hook can exfiltrate SSH keys before you notice. Airgap, a new tool by Sven Sauleau, addresses both by intercepting system calls at the kernel level and hiding secrets before the process sees them.
This is not prompt filtering or environment variable masking. Airgap uses Linux namespaces to create an isolated view of the filesystem where sensitive files either do not exist or contain placeholder values. The agent or package manager runs normally, but the kernel lies about what is on disk.
The Attack Surface
Two threat models converge:
AI agents with filesystem access
Tools like Claude Code or OpenCode scan your project and home directory. Every file they read might end up in a prompt sent to a third-party API. A malicious plugin can grab .env, ~/.ssh, or ~/.npmrc without triggering any application-level guardrail.
npm install hooks
Malicious packages use preinstall and postinstall scripts to run arbitrary code during dependency installation. Recent campaigns (Shai-Hulud, Miasma, pgserve, fake tanstack) all follow the same pattern: steal credentials from .env, ~/.npmrc, ~/.aws, and ~/.ssh, then exfiltrate them. Shai-Hulud went further by republishing backdoored versions of other packages the compromised developer maintained, creating a self-replicating worm.
Agents make this worse because they run npm install on hallucinated or attacker-registered package names (slopsquatting). The agent does not know the package is malicious, and the install hook runs before any human review.
How Airgap Works
Airgap is a wrapper that launches a process inside Linux namespaces. It intercepts filesystem operations at the kernel level and rewrites paths or file contents before the process sees them.
Namespace isolation
The process runs in a mount namespace with a modified view of the filesystem. Sensitive files are either hidden (the path does not exist) or replaced with dummy values. The process cannot escape the namespace without kernel exploits.
File interception
Airgap hooks system calls like open, read, and stat. When a process tries to access a protected file, the kernel returns a fake file descriptor or ENOENT. The process does not know the real file exists.
Gating for package managers
When a package manager tries to access a file it should not touch, Airgap pauses execution and prompts the user. You see the file path and the process name, then allow or deny. This catches install hooks trying to read .env or ~/.ssh.
Secrets still work where needed
Airgap does not block all secret access. You configure which processes and paths are allowed. An agent tool that needs an API key can still read it if you explicitly permit that combination. The default is deny.
Architecture
Airgap runs in user space as a wrapper. It creates a mount namespace in kernel space and intercepts syscalls (open, read, stat) to hide or replace sensitive files. The flow looks like this:
User space layer
AI agents (like claude) and package managers (npm install with preinstall hooks) both run inside the Airgap wrapper. The wrapper creates the namespace before executing the target process.
Kernel space layer
System call hooks intercept file operations. The namespace manager enforces the isolated filesystem view. Protected paths are bind-mounted to empty files or directories.
The wrapper creates a mount namespace before executing the target process. Inside the namespace, protected paths are bind-mounted to empty files or directories. The kernel enforces this view. The process cannot see the real filesystem without breaking out of the namespace.
Configuration Example
# airgap.yml
secrets:
- path: ~/.ssh
action: hide
- path: .env
action: replace
value: "PLACEHOLDER=redacted"
- path: ~/.npmrc
action: hide
allow:
- process: /usr/bin/gh
path: ~/.config/gh/hosts.yml
- process: /usr/local/bin/aws
path: ~/.aws/credentials
gate:
- process: npm
paths:
- ~/.npmrc
- .env
- ~/.sshWhen an agent runs npm install, any attempt to read ~/.npmrc triggers a prompt. You see the package name and the file path, then decide. If you deny, the process gets EACCES. If you allow, the read succeeds but is logged.
Trade-Offs and Failure Modes
| Aspect | Airgap Approach | Limitation |
|---|---|---|
| Isolation boundary | Kernel namespaces | Requires Linux; macOS support incomplete |
| Secret visibility | Hidden at syscall layer | Agent cannot use secrets even when legitimate |
| Performance | Syscall interception overhead | ~5-10% latency on file operations |
| Escape risk | Namespace breakout requires kernel exploit | Vulnerable to kernel CVEs (rare but possible) |
| Agent functionality | Agent sees placeholder values | May break tools that validate secret format |
| User friction | Manual approval for gated access | High prompt volume during dependency installs |
Fail-closed by default
If Airgap cannot determine whether a file access is safe, it denies. This breaks some workflows but prevents leakage. You tune the allow list over time.
No protection against logic bugs
If your agent has a tool that legitimately reads a secret and then logs it, Airgap does not help. It only prevents unauthorized filesystem access. Application-layer bugs require different controls.
Kernel dependency
Airgap relies on Linux namespaces and seccomp-bpf. It does not work on macOS or Windows without a compatibility layer (VM or container). The macOS port is in progress but not production-ready.
When to Use Airgap
You run AI agents with filesystem access
If your agent reads project files or home directories, Airgap prevents accidental secret leakage to model providers. This is especially important for agents that scan entire directories or use plugins from third parties.
You install dependencies from untrusted sources
If you run npm install on packages you did not audit, Airgap catches install hooks trying to steal credentials. This includes CI/CD pipelines where agents or humans install dependencies automatically.
You need defense in depth
Airgap complements other controls like secret managers, environment variable isolation, and network egress filtering. It does not replace them. Use it as one layer in a multi-layer security model.
When to Avoid Airgap
Your agents need real secrets
If your agent tools require access to production credentials, Airgap forces you to either allow everything (defeating the purpose) or manually approve every access (high friction). In that case, use a secret manager with scoped access tokens instead.
You are not on Linux
Airgap requires Linux kernel features. If you run agents on macOS or Windows, you need a different approach (VM, container, or application-layer filtering).
You trust your dependencies
If you only install packages from vetted sources and run agents in isolated environments, the overhead of kernel-level interception may not be worth it. Simpler controls like read-only filesystems or secret managers may suffice.
Technical Verdict
Airgap solves a real problem: AI agents and package managers both run untrusted code with filesystem access, and application-layer controls are easy to bypass. Kernel-level interception is harder to evade than prompt filtering or environment variable masking.
The trade-off is friction. Gating every secret access requires manual approval, and agents that need legitimate access to credentials become harder to use. The Linux-only requirement also limits adoption.
Use Airgap when you run agents or install dependencies in environments where secret leakage is a critical risk and you can tolerate the operational overhead. Skip it if your agents need frequent access to real secrets or you are not on Linux.
For most agent deployments, combine Airgap with secret managers, network egress controls, and read-only filesystems. No single control stops all exfiltration, but layering them makes attacks much harder.