Your AI coding agent is leaking secrets. Here’s how it happens.
AI coding agents are designed to read everything in your project: source files, configs, terminal errors, and environment variables. That broad context is exactly what makes them useful. It’s also why your .env file is now a liability.
Two Ways Secrets Escape
The obvious path is a developer pasting a failing API call directly into chat to debug a 401 error, credentials and all. At least that’s visible. The quieter path is the dangerous one: the agent reads your project files to build context, and your .env rides along in the prompt sent to the model provider. Nobody typed anything into a chat box. The key just went with the context.
Once that happens, the secret sits in provider logs and gateway logs, often in plain text, across systems you don’t own or control. Rotating the key closes the door going forward, but does nothing about the prompt history already sitting in someone else’s data retention.
This Already Happened in the Wild
Earlier this month, a security researcher caught xAI’s Grok Build coding agent uploading developers’ entire Git repositories to a cloud storage bucket. A canary API key and database password placed in a .env file appeared verbatim and unredacted in the transmitted traffic, as reported by Cybernews and The Next Web.
That was a bug. Supply chain attackers are now doing this on purpose. Sonar’s team analyzed a series of attacks including Mini Shai-Hulud, described as the first in-the-wild supply chain attack built to persist through AI coding agent sessions. It hunts for more than 80 environment variables and more than 130 file paths, including ~/.aws/credentials, ~/.ssh/, ~/.npmrc, database strings, and wallet files.
The Remediation Window Is 94 Days
Even for secrets you can find and fix, the median time to remediate a leaked secret in a public repository is 94 days, according to the Verizon 2025 Data Breach Investigations Report. That’s three months for an automated scanner to locate and abuse a leaked credential.
️ Where Detection Has to Live
The source article argues that detection must run before the secret leaves your machine, and it must run in a dedicated scanner separate from the agent itself. A secret should be blocked by a rule, not by the model’s own judgment.
SonarQube’s secrets detection covers 450+ secret patterns across 248 cloud services with a false-positive rate under 5%. Their tooling covers Claude Code, GitHub Copilot CLI, Codex, Cursor, Antigravity, and others. The IDE plugin flags secrets as you type. The CLI and agent plugins scan locally at roughly 100 ms per file inside the agent loop. SonarQube Cloud and Server catch anything that makes it to a PR before it can merge.
The Operator Takeaway
If you’re using any AI coding agent daily, the .env files sitting in your project roots are getting read and transmitted. The fix isn’t to stop using agents. It’s to add a scanning layer that runs locally before the context ships. That layer needs to be independent of the model, not a feature the model itself provides.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
