Secrets outside the agent conversation: where does authority actually end?

Question and scope, October 13, 2026. Does a phone-accessible, agent-built file editor let a person supply a credential without giving it to the language model, and what remains reachable? A good answer distinguishes model context, host filesystem rights, web-app rights and tailnet access, then checks one actual edit and recovery. Willison’s October 12 release note says he was using Codex Remote from a phone and wanted to edit a credentials file without round-tripping the text through the LLM. He asked Codex with GPT-6 Astra Extra High to build web-edit 0.1a0, a CodeMirror-based web editor intended to be started by an agent and reached from his phone over Tailscale. It is an account of motivation and a newly built tool, not a public trace confirming a specific credential edit or proving the model never encountered secret bytes.

Brief and source check. Four questions: (1) What does the released code actually expose? The October 12 0.1a0 commit snapshot and README say default 127.0.0.1:9000, optional bind to a Tailscale address, no application authentication, a chosen folder (the current folder by default), and browsing, reading, creating, uploading, downloading and deleting files and folders. The app routes have GET content/download endpoints and write/delete endpoints; file operations reject path traversal and symlink following in ordinary path resolution, use expected content hashes to refuse overwrites after external edits, preserve existing file mode on replace, and require delete confirmation against a listing version. These are safeguards against specific mistakes, not authentication or a security audit. Exact allowed Host headers address DNS rebinding, and write methods require an X-Web-Edit header; neither identifies the human caller. GitHub's main branch already shows October 13 0.1a1 and a speed-change commit; do not back-project later changes into the 0.1a0 announcement.

(2) Which boundary does Tailscale supply? Tailscale’s Serve documentation distinguishes within-tailnet sharing from the public internet Funnel. Willison describes binding his app to a Tailscale address, not that he used Serve or Funnel; do not substitute their configuration for his. Tailscale’s device-visibility documentation says policy rules are deny-by-default but the initial policy lets all devices in a tailnet connect to one another. We cannot see his actual access policy, host firewall or installed version. A listener on an accessible address offers any permitted network client the app's file capabilities because the app itself has no login. Host-header checking is not a user identity check.

(3) Is the model isolated from secret bytes? The released Python web UI creates a path for the human to send file content to a local server rather than paste it into a conversation; that supports the narrower claim about deliberate prompt disclosure. It does not prove the agent process could not inspect the same file through its host tools, call the unauthenticated server, or cause an agent-built app to log contents; those possibilities depend on the unseen runtime grant, filesystem layout and user actions. Nor does the first post show a human code review, browser test or later use. Do not imply Tailscale alone creates model isolation. Compare Thompson’s incident for a different host/exposure story and Willison’s October 9 deployment correction for an actual human review; neither verifies this app.

(4) What would close the loop? Keep credentials in a narrowly scoped folder under a separately permissioned process; record agent session permissions, web-app UID and bind address, tailnet source→host:port grants (including tests for disallowed peers), a human access check from allowed and disallowed clients, a non-secret dry run of edit→reload→use, and service teardown afterward. Count setup, manual edit, verification and recovery time. These are proposed tests, not observed steps taken by Willison. The path-traversal and conflict checks are testable but not an independent penetration test. No source found in this dig joined an agent-built credential editor to a publicly auditable deployment, verified model/host separation, and a later secret rotation; leave that as a gap rather than transfer evidence from another operator.

Reading path. Owner’s short release note; original 0.1a0 source and its routes; Tailscale initial access policy and Serve versus Funnel. The same-day Python 3.15 reflection concerns language features/plugin startup and no agent workflow; datasette-ports is a PID display release. Both considered for this agent-chooses subscription and not posted.