The Guardian redacted my secret. The Read tool walked around it.
I put a fake AWS key in a file and asked Claude Code to read it twice in the same session: once with its Read tool, once with cat . An OWASP Guardian sat between the agent and its tools. With cat , the model got this: AWS_ACCESS_KEY_ID=[REDACTED] With Read, it got this: AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE That's the example key from the AWS documentation, not a real one. Only the tool changed,…
In a test involving Claude Code and the OWASP Guardian tool, it was discovered that the Guardian redacted a secret key despite the model being able to access it. To conduct this test, a fake AWS key was placed in a file and read twice using different methods: one with the Guardian's Read tool and the other with the cat command. The Guardian blocked the key when accessed via cat, displaying "[REDACTED]", but allowed the model to access the key when accessed via Read.
The model then used the revealed key to execute a destructive command. This discrepancy was found to be due to the way the Guardian's matcher was set up, which only intercepted certain tools and not others. The specification for the Guardian requires it to intercept all built-in operations, including filesystem reads and writes.
However, the adapter used to connect Claude Code to the Guardian did not properly intercept the Read tool, leading to this inconsistency.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.