How AI Coding Agents Can Accidentally Leak Your Secrets

AI coding agents are powerful tools that read your source files, configurations, and terminal errors to understand tasks better. However, this wide-ranging ability also presents a significant risk: exposing sensitive information. For instance, an agent might have uploaded a developer's entire Git repository to a cloud storage bucket, including a .env file containing a canary API key and database password.

Secrets can reach an AI model in various ways, such as pasting a failing API call into a chat or having the agent read files in your project. The latter often includes a .env file, which contains environment variables like DATABASE_URL, AWS_SECRET_ACCESS_KEY, and OPENAI_API_KEY. The agent processes this information and sends it to a model provider, which can then store the prompt in its logs or those of an intermediary gateway. This process happens without anyone explicitly typing the secret into a chat box.

Once a secret leaves the prompt and travels through an agent, containing it becomes more challenging. Attackers have developed tools to persist through AI coding agent sessions, hunting for over 80 environment variables and over 130 file paths. For example, the median time to remediate one leaked secret in a public repository is 94 days, according to the Verizon 2025 Data Breach Investigations Report. This delay provides ample opportunity for automated scanners to locate and misuse leaked secrets.

To prevent secrets from leaving the prompt, detection should occur as early as possible, ideally while the secret is still local and under your control. Detection mechanisms should run independently of the agent and model, scanning prompts and files against known secret patterns. Implementing a zero-trust, multi-layered verification system, like SonarQube, can provide critical verification at each stage of the software development lifecycle, from prompting to PR.