Where AI agents leak your keys

The question Where do our secrets end up?

Six paths, side by side

Each path starts with a key an agent can reach and ends with a copy you no longer control.

In the request to the model

Each time an agent asks its model what to do next, it sends the conversation so far. That includes what it has read: a pasted stack trace, a config file, the output of env. A key in any of them leaves with the request.

GIRD's case study saw this on one company's engineering laptops, in observation mode with nothing blocked. Four named keys left inside ordinary agent requests: two GitHub access keys and two Shopify store keys. A key counts as named when its prefix shows which service it opens. Three of the four went to api.anthropic.com.

A separate, unidentified token went to the same address 216 times in 16 hours. Its shape matches a Supabase service-role key, which can read and change any row in its database. Its type was never established. These requests went to the AI vendor the team had approved, inside traffic the agents send all day. None of it looked like an incident.

In .env and shell files the agent reads

Agents read files to do their work, and keys live in files. They sit in .env files, in shell profiles such as ~/.zshrc, in ~/.aws/credentials and in kubeconfigs. When an agent opens one to debug a failing call, the key enters its context. From there it goes into the next request and the transcript.

A .gitignore entry doesn't help here. It keeps a file out of commits, not out of the agent's reach. In the case study, agents' own processes opened password and key files 19 times one week and 29 the next, across six files.

In plain text: MCP configs, agent settings and transcripts

MCP servers need credentials, and the quickest setup pastes a token into the config. Claude Code keeps personal MCP server configs in ~/.claude.json. Codex keeps them in ~/.codex/config.toml, where an env block passes variables to the server. GitGuardian's 2026 report counted 24,008 unique secrets in MCP configuration files on public GitHub, 2,117 of them valid.

Agent settings collect keys too. In Claude Code, choosing "Yes, and don't ask again" saves the approved command as an allow rule in .claude/settings.local.json. If the command carried a key, the file now holds it. Lakera scanned about 46,500 npm packages and found that file in 428. Thirty packages shipped live credentials in it, across 33 files.

Then there are transcripts. Claude Code writes every message, tool call and tool result to a plain-text file under ~/.claude/projects/, and keeps it for 30 days by default. Its documentation is direct: if a tool reads a .env file, that value is written to the transcript. Codex has a setting that controls whether it saves transcripts to history.jsonl. Anything that can read your home folder can read these files.

In files the agent writes and pushes

Agents write files, and sometimes a key goes into one. In the case study, a GitHub access key was written into a Terraform state file and uploaded to S3. The same key had gone to AWS Amplify minutes earlier. HashiCorp's documentation says Terraform stores secrets from your configuration in its state and plan files. Anyone who can read those files can read the values.

Commits carry keys too. GitGuardian found 28.65 million new hardcoded secrets in public GitHub commits in 2025, up 34% on the year before. Leaked secrets for AI services rose 81%, to 1,275,105. Commits co-authored with Claude Code leaked secrets at 3.2%, against a 1.5% baseline. GitGuardian notes that developers still decide what gets accepted or pushed.

With malicious packages and extensions

Some malware now hunts for agent keys, and some of it uses the agents. In August 2025, trojanised Nx packages ran the AI command-line tools on developers' machines with permission checks disabled. Claude Code, Gemini CLI and Amazon Q were among them, and were told to search the machine for secrets. Wiz counted over a thousand valid GitHub tokens leaked in the first phase.

In August 2026, the CHAINDROP worm reached over 400 npm packages. Elastic Security Labs found its harvester aimed at Anthropic, Claude, Codex, Cursor, OpenAI and Gemini credentials. It also planted a Claude Code SessionStart hook, so it ran again whenever someone started a new session in an infected repository.

On 21 October 2026, a compromised LiteLLM release, 1.107.0, reached PyPI and Docker Hub. It carried malware that steals credentials and ran on any Python start in an affected environment. The maintainers told users to rotate everything the host could reach.

Editor extensions do it too. In October 2025, Koi Security found GlassWorm in extensions on OpenVSX and Microsoft's VS Code marketplace, hidden in invisible Unicode characters. It went after GitHub, npm and OpenVSX credentials and used them to spread, across an estimated 35,800 installations.

An agent nobody uses is still a target. In the case study, 8 of the 14 installed coding agents recorded no session at all, and all stayed installed. That is what the Nx malware used: coding agents already on developers' machines. To list yours, see Shadow AI agents: what they are and how to find them.

What to do about it

Find them. Start with one computer. Blindspot, GIRD's open-source, read-only check, runs on macOS, Linux and Windows. It lists the coding agents and MCP servers on the machine, and any token written into an MCP config. It finds AI and cloud keys in shell profiles, shell history, agent configs and .env files, plus keys saved in Claude Code allow lists. It names the provider and the file, never the key. Run it yourself in a terminal, not through an agent: an agent asked to find keys has to read them. Finding nothing doesn't prove a key never leaked.

Rotate them. Treat any key that reached a model provider, a public repository or a malicious package as exposed. Revoke it at the provider and issue a new one. GitHub's guidance is to revoke or rotate first. The old commits can survive a history rewrite in clones, forks, cached views and pull requests. If malware may be on the machine, take it offline and rotate from another computer. Anything typed or saved on an infected machine can be stolen too, including the new key.

Keep keys out of agent context. Deny agents read access to credential and .env files; Claude Code's settings docs show Read(./.env) as a deny rule. In Codex, set shell_environment_policy.ignore_default_excludes to false, so commands it runs don't inherit variables whose names contain KEY, SECRET or TOKEN. Reference MCP tokens through environment variables, such as Codex's bearer_token_env_var, rather than pasting them into configs. Shorten transcript retention. For how much access an agent should get at all, see Least privilege for AI agents.

Redact before sending. Rules inside one agent cover only that agent. Check what leaves the device, not only what sits on disk. A key caught in an outgoing request can be removed before it reaches the model provider.

In India, check your reporting duty too. CERT-In's directions of 28 April 2022 apply to service providers, intermediaries, data centres, body corporates and government organisations. They must report listed incidents within six hours of noticing them. The list includes unauthorised access to IT systems or data, malicious code attacks and data leaks. See CERT-In, DPDP and AI agents.