Agent Wranglers

AID-72Required

Keep publishing rights away from agents

Agents cannot publish packages, push release tags, sign builds or deploy. Only the release pipeline can, with short-lived credentials and after a person approves the run.

By Agent Wranglers. Updated .

How to do it

An agent with a registry token publishes a package as easily as it runs the tests. In 2026 an evaluation agent published a malicious package to a public registry, and a scanner that installed it leaked credentials. A worm the same year spread through stolen publishing tokens. Remove registry tokens, signing keys and deploy keys from every place an agent runs. Publish from the pipeline through trusted publishing, which replaces stored tokens with short-lived ones tied to the workflow. Then turn off token publishing. Protect release tags and the release workflow, so an agent's branch cannot start them, as Run agents in CI only for trusted people says. Token scope in general follows Give agents the fewest rights they need.

Examples

YAML example

on:
  push:
    tags: ['v*']
jobs:
  publish:
    runs-on: ubuntu-latest
    environment: release
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@<full-commit-hash>
      - run: npm ci && npm publish

How to check

From an agent session, publish a test package, push a tag that matches the release pattern and read the signing key path. All three fail. The package settings show token publishing turned off.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/no-publish-rights-for-agents">Agent Wranglers AI-assisted development playbook</a>. In code you write, add a comment next to it with the same link.