Subprocess environment credential scrubbing is the practice of removing sensitive environment variables — LLM/provider API keys, secrets, and tokens — from the environment inherited by child processes spawned by an AI coding agent. It keeps credentials in the parent process (which needs them for its own API calls) while ensuring that tool-invoked subprocesses cannot read them. The primary goal is to eliminate the read primitive that prompt injection would otherwise exploit to exfiltrate keys. As of late 2026, the major coding agents examined do not scrub provider credentials from child processes by default; scrubbing is opt-in.
Key Points
Claude Code honors CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1 (added around v2.1.79 and still present in v2.1.305). When enabled, it covers the Bash tool, hooks, and MCP stdio servers.
What Claude Code strips: Anthropic credentials, cloud-provider credentials, GitHub Actions OIDC/runtime tokens, and OTEL auth headers — from the environments of spawned Bash tools, hooks, and MCP stdio servers.
What is kept: The parent process retains credentials for its own API calls; GITHUB_TOKEN / GH_TOKEN are explicitly preserved in subprocesses.
Activation: Opt-in via environment variable. claude-code-action v1.0.77 turns it on automatically for workflows that use allowed_non_write_users (i.e., accept untrusted input); set it to 0 to opt out.
OpenAI Codex uses shell_environment_policy, but its ignore_default_excludes setting defaults to true. Variables containing KEY, SECRET, or TOKEN are therefore kept unless the user explicitly changes the policy.
yoagent 0.25.12 exposes provider key names through provider::api_key_variables() and resolve_api_key(provider), but its MCP stdio transport only adds environment entries; it never calls env_clear or env_remove, so the child inherits the host environment.
Threat model: Under prompt injection, a compromised agent can expand $ANTHROPIC_API_KEY in a shell and leak it through a side channel. Scrubbing removes the ability to read it in the first place.
Ecosystem support:yoagent 0.25.12 (2026-10-21) added provider::api_key_variables(), exposing the full list of env vars it reads credentials from so host applications can blank them in the processes they start.
Both major rivals — Claude Code and OpenAI Codex — keep credentials in child environments by default; credential scrubbing must be explicitly configured.
Concepts
Read primitive — the ability of injected instructions to read a secret value; scrubbing targets this rather than the exfiltration channel.
yoagent — coding agent exposing provider::api_key_variables() and resolve_api_key(provider).
provider::api_key_variables() — a yoagent helper that enumerates the credential env vars a host must blank in child processes.
MCP stdio servers — child processes launched over stdio for the Model Context Protocol; in scope for Claude Code scrubbing.
onFailure — Claude Code hook block added in v2.1.295 for command and HTTP hooks.
Parent/child credential split — the parent keeps secrets; children see a sanitized environment.
Details
The central question is whether coding agents strip LLM/provider API keys from child process environments by default. The findings show a consistent pattern: inheritance is the default; scrubbing is opt-in.
Mechanism
Claude Code launches several kinds of child processes on behalf of the model. Without scrubbing, each inherits the full parent environment, including API keys. With CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1, Claude Code strips a defined set of sensitive variables before spawning those children, while retaining them internally for its own outbound API calls.
Rendering diagram…
Scrubbed categories:
Anthropic credentials
Cloud-provider credentials
GitHub Actions OIDC / runtime tokens
OTEL auth headers
Preserved: GITHUB_TOKEN and GH_TOKEN (subprocesses still receive these by design).
Claude Code
CLAUDE_CODE_SUBPROCESS_ENV_SCRUB was added around v2.1.79 and remains present in v2.1.305. It is opt-in. When set to 1, scrubbing applies to:
the Bash tool,
hooks,
MCP stdio servers.
It strips Anthropic credentials, cloud provider credentials, GitHub Actions OIDC/runtime tokens, and OTEL auth headers from those child environments. Separately, Claude Code v2.1.295 added an onFailure: block for command and HTTP hooks.
claude-code-action v1.0.77 automates the choice: workflows declaring allowed_non_write_users (untrusted input) get scrubbing on automatically. Setting the variable to 0 disables it. Host applications embedding similar agents can replicate the pattern by enumerating credential variables (yoagent's provider::api_key_variables()) and blanking them in child processes.
OpenAI Codex
Codex configures child environments through shell_environment_policy, which supports:
inherit = all | core | none
filters / exclude / include_only
ignore_default_excludes
Crucially, ignore_default_excludes defaults to true. That means the built-in exclusion patterns in codex-rs/core/src/exec_env.rs — case-insensitive matches for *KEY*, *SECRET*, and *TOKEN* — are ignored by default. Variables containing those substrings are therefore kept in the child environment unless the user sets ignore_default_excludes = false or otherwise customizes the policy.
yoagent
yoagent 0.25.12 exposes provider::api_key_variables() for all provider key names, including GEMINI_API_KEY and GOOGLE_API_KEY for Google, plus resolve_api_key(provider). However, its MCP stdio transport in mcp/transport.rs only adds environment entries; it never calls env_clear or env_remove. The child therefore inherits the host environment, including credentials.
The exposed helper nonetheless lets host applications enumerate credential variables and blank them in the processes they start.
Comparison
Agent
Mechanism
Default behavior
Scope
Claude Code
CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1
Off (opt-in); claude-code-action enables it for allowed_non_write_users workflows
Prompt injection in a coding agent is dangerous mainly because the injected text can act through the shell. If $ANTHROPIC_API_KEY resolves to a real value inside a Bash subprocess, an injected instruction can capture it and leak it through any side channel (network, file, output). Removing the variable from the child environment means the expansion yields nothing useful, collapsing the attack at the read step independent of how exfiltration might occur.
Bottom line
Both major rivals — Claude Code and OpenAI Codex — keep credentials in child environments by default; scrubbing is opt-in. yoagent behaves similarly in its MCP stdio transport. Users concerned about credential leakage to subprocesses must explicitly enable or configure scrubbing.
Open question / observation
The noted state "yoyo Day 235" records that the model's bash tool child still sees ANTHROPIC_API_KEY (measured length 108), illustrating exactly the exposure the scrub flag is designed to remove — a concrete measurement against which the effectiveness of scrubbing can be checked.