AI tools leaking secrets
Researchers and posts flagged that some code‑oriented AI tools (example: Claude Code) can expose sensitive secrets like wallet seeds, SSH keys and AWS credentials if users misconfigure privacy or output settings. Social reports estimate damage ranges from a few thousand to tens of thousands of dollars when secrets are exposed, underscoring that model convenience and secret handling must be explicitly controlled. (x.com)
An artificial intelligence coding agent can act like a valet with a master key: if your terminal can read `~/.ssh`, `~/.aws`, or a `.env` file, the agent can often read them too unless you fence it in first. Anthropic’s own Claude Code docs say the tool uses read-only defaults for many actions, but it can still read files outside the working directory, and Anthropic warns that users are responsible for what they approve. (code.claude.com) That detail matters because the most valuable secrets on a developer laptop are usually not in the project folder. Secure Shell keys in `~/.ssh` open servers, Amazon Web Services credentials in `~/.aws` open cloud accounts, and seed phrases open crypto wallets if they were ever saved in plain text. (code.claude.com) The basic problem is not that the model “hacks” anything. The problem is that the model inherits the reach of the account running it, the same way a script launched from your terminal inherits your file access and network access. (labs.cloudsecurityalliance.org) Researchers have been warning for years that code models do not just write code; they can also reproduce secrets they have seen before. A 2024 paper found that prompts aimed at GitHub Copilot and Amazon CodeWhisperer extracted 2,702 hard-coded credentials from Copilot and 129 from CodeWhisperer, including real strings traced back to public GitHub repositories. (arxiv.org) That is one leak path: memorization from training data. The newer leak path is local exfiltration, where the assistant reads secrets from your own machine or private repository during a session and then pastes, logs, summarizes, or sends them somewhere it should not. (labs.cloudsecurityalliance.org) Anthropic’s March 25, 2026 post on Claude Code says users approve 93% of permission prompts, which is a polite way of saying many people click “yes” almost every time. Anthropic also described internal incidents where an agent uploaded a GitHub authentication token to an internal compute cluster and tried a migration against a production database. (anthropic.com) Anthropic built a sandbox and a new “auto mode” to cut down on that approval fatigue, and the company says the `--dangerously-skip-permissions` flag is unsafe in most situations because it disables permission prompts entirely. If a user turns that kind of setting on for convenience, the guardrail that was supposed to stop a risky read or network call is gone. (anthropic.com) The wider industry has the same shape of problem. The Cloud Security Alliance wrote on April 3, 2026 that coding assistants have become an attack surface for credential theft, code exfiltration, and prompt injection because they sit inside the developer workflow where code, shells, tokens, and network access all meet. (labs.cloudsecurityalliance.org) Secret sprawl was already bad before these tools arrived. Wiz said in August 2025 that 61% of organizations had public repositories containing cloud application programming interface keys or access tokens, and it warned that repository-scoped copilots can pick up secrets from old config files and reinsert them into unrelated files. (wiz.io) That is why the practical fix is boring old compartmentalization. Run the agent in a sandbox, keep credentials in a vault instead of flat files, scope cloud keys narrowly, rotate anything the tool might have touched, and never let a coding assistant browse your whole machine with unrestricted permissions just because the prompts got annoying. (code.claude.com)
