Every AI coding agent writes the secrets you paste straight to a plaintext history file — and nobody scans it

AI coding assistants such as Claude Code, Cursor, and OpenAI Codex log full conversation histories, including pasted secrets, to local plaintext JSONL files on disk. These secrets accumulate over time and remain accessible indefinitely, creating a new category of credential exposure. This local storage is not currently scanned or audited widely, increasing the risk of secret leakage, especially from supply chain malware that scans developer machines for credentials. The open-source tool agentsweep addresses this by scanning local history files for secrets using ~207 detection rules and BIP-39 seed phrase detection, supporting about 30 AI coding agents. It can redact secrets in place with atomic writes and backups, providing a local, offline remediation method to reduce the attack surface from leaked secrets in AI agent histories.

Secrets such as API keys, database URLs, environment variables, and cloud credentials pasted into AI coding agents are stored in plaintext on local disk indefinitely. This persistent storage increases the risk of credential leakage through local compromise or supply chain attacks that scan developer machines for secrets. Attackers can exfiltrate multiple secrets from these history files if they gain access. The exposure is compounded by the fact that these secrets are reused as context by the AI agents, causing them to resurface repeatedly. This creates a significant risk of unauthorized access to cloud services, databases, and other sensitive resources if secrets are not rotated or removed.

Currently, there is no official vendor patch or fix for this issue as it stems from design choices in AI coding agents. The recommended mitigation is to avoid pasting secrets into cloud-backed AI agents to prevent them from being sent to provider servers. For secrets already stored locally, use the open-source tool agentsweep to scan and redact secrets from local AI agent history files. agentsweep performs safe, atomic redactions with backups and validation, reducing the risk of secret exposure on disk. Organizations should consider auditing local AI agent histories for secrets and rotating any exposed keys. Using locally hosted AI models that do not send data to cloud providers can also reduce exposure.