I wonder, why not use an LSM like Tomoyo, App Armor or SELinux to not allow the AI to read the secrets file? That way you could be certain that it could not be tricked into doing so.