Yes, that is exactly the problem. People treat PYTHONPATH just like PATH, but the "easy scripting tricks" that are fine with PATH become subtle security vulnera

Yes, that is exactly the problem. People treat PYTHONPATH just like PATH, but the "easy scripting tricks" that are fine with PATH become subtle security vulnerabilities when you do the same thing with PYTHONPATH. E.g., people will often add a directory to PATH by doing: PATH="$PATH:my_new_dir" This is practically always fine for PATH, since it's practically always set. If you use exactly the same syntax with PYTHONPATH, you have an instant security vulnerability. Now the first directory searched is the current directory, and if you ever wander into directories with untrusted fils (like "Downloads/" or "somebody_elses_container/") it could become serious fast. This is a sharp edge that was never intended. I'm going to look into proposing this as a PEP. The change is trivial, but there may be surprising uses. A PEP would mean that it'd get more scrutiny (so the change will be less likely to be reverted later).