AI coding agents need a secrets-safe context boundary
The New Stack Taylor Luttrell-Williams ● Covered by 11 sources
AI coding agents can quietly suck in secrets from local files and send them out. That means the leak can happen before Git, code review, or CI ever sees it.
Based on reporting by The New Stack, Taylor Luttrell-Williams — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
AI coding agents are being sold as a productivity boost, and they do real work: they can chase down bugs, trace dependencies, refactor services, and draft patches without a developer gathering every scrap of context by hand. The catch is that they’re hungry for context. They read source files, configs, terminal output, error messages, environment data, and anything else that might help them reason about the task.
That appetite creates a new secret-leak path. A human might paste a bad API call into a chat window and accidentally include a token; ugly, but familiar. The quieter problem is an agent poking through its working directory and finding a forgotten .env file, a cloud credential profile, SSH settings, or sensitive logs. Nothing about that looks malicious from the agent’s point of view. It is just doing what it was built to do.
Once a secret is pulled into that context, it can travel further than most teams expect. Depending on the workflow, it may show up in model provider logs, gateway telemetry, prompt histories, or debugging records. Rotating the credential helps, but it does not wipe out copies that may already exist in those systems. The leak is no longer just about what ends up in a repository; it is about what the agent reads and forwards before anyone notices.
That is why old security gates are not enough by themselves. Commit checks, pull requests, builds, and deployment controls still matter, but they arrive too late to stop a secret from entering an agent prompt in the first place. The article points to the 2025 Verizon Data Breach Investigations Report, which gives a median of 94 days to remediate leaked secrets found in GitHub repositories. In an agent-driven workflow, that is an eternity.
The fix it argues for is blunt and practical: treat agent context as an egress surface and put deterministic secrets detection before submission, not after. Scan prompts and file reads locally, block or redact credential-shaped values, and keep the model out of the decision loop. Sonar’s example is plugins for tools like Claude Code, GitHub Copilot, Codex, and Cursor, but the broader point is simpler: if an AI tool can read it, it can leak it.
My take — AI-written commentary, not fact-checked reporting
This is the part of AI coding that gets hand-waved away until someone ships a token into a prompt history and spends a week cleaning up the mess. The industry loves calling these tools copilots, but when they start vacuuming up local state, they are also data movers. Security teams should stop pretending a pull request is the first place a secret can go wrong.
Read more about this at: The New Stack