diff --git a/hub/package-lock.json b/hub/package-lock.json
index f569594..e09330d 100644
--- a/hub/package-lock.json
+++ b/hub/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.18",
+  "version": "0.0.17",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@paradigm/hub",
-      "version": "0.0.18",
+      "version": "0.0.17",
       "dependencies": {
         "@anthropic-ai/claude-agent-sdk": "^0.3.202",
         "@fastify/cookie": "^11.0.2",
diff --git a/hub/package.json b/hub/package.json
index 6126130..bb661ba 100644
--- a/hub/package.json
+++ b/hub/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.18",
+  "version": "0.0.17",
   "private": true,
   "type": "module",
   "engines": {
diff --git a/hub/src/agent/security.ts b/hub/src/agent/security.ts
index 7601c3e..1f7dfc3 100644
--- a/hub/src/agent/security.ts
+++ b/hub/src/agent/security.ts
@@ -23,6 +23,11 @@ const SAFE_HOST_ENV_KEYS = [
   "CPH_BIN",
 ] as const;
 
+const SANDBOX_HIDDEN_ENV_KEYS = [
+  "ANTHROPIC_AUTH_TOKEN",
+  "ANTHROPIC_API_KEY",
+] as const;
+
 // Linux sockaddr_un.sun_path is 108 bytes including the terminator. Claude's
 // sandbox appends its own user directory and randomized bridge socket names,
 // so keep our prefix well below that hard limit.
@@ -151,9 +156,7 @@ export async function createAgentSecurityPolicy(input: AgentSecurityInput): Prom
       },
       credentials: {
         files: sensitiveReadPaths.map((path) => ({ path, mode: "deny" as const })),
-        // These values are short-lived loopback capabilities, not Organization
-        // provider secrets. Denying them also strips Claude's own request auth.
-        envVars: [],
+        envVars: SANDBOX_HIDDEN_ENV_KEYS.map((name) => ({ name, mode: "deny" as const })),
       },
     },
   };
diff --git a/hub/test/unit/agent-security.test.ts b/hub/test/unit/agent-security.test.ts
index 2f3703a..e359a83 100644
--- a/hub/test/unit/agent-security.test.ts
+++ b/hub/test/unit/agent-security.test.ts
@@ -66,7 +66,10 @@ describe("agent subprocess security policy", () => {
         allowRead: expect.arrayContaining([canonicalWorkspace, "/usr/bin"]),
       },
       credentials: {
-        envVars: [],
+        envVars: expect.arrayContaining([
+          { name: "ANTHROPIC_AUTH_TOKEN", mode: "deny" },
+          { name: "ANTHROPIC_API_KEY", mode: "deny" },
+        ]),
       },
     });
   });
diff --git a/hub/test/unit/runner.test.ts b/hub/test/unit/runner.test.ts
index f423473..7ddd450 100644
--- a/hub/test/unit/runner.test.ts
+++ b/hub/test/unit/runner.test.ts
@@ -288,7 +288,10 @@ describe("runAgent", () => {
         },
         sandbox: {
           credentials: {
-            envVars: [],
+            envVars: expect.arrayContaining([
+              { name: "ANTHROPIC_AUTH_TOKEN", mode: "deny" },
+              { name: "ANTHROPIC_API_KEY", mode: "deny" },
+            ]),
           },
         },
       },