Secrets in an AI agent's session logs: how the measurement was done
One operator, 70 deployment secrets, four weeks of work with an AI coding agent. At the end, 68 of the 70 values sat in plain text in its session logs. This page sets out how that was measured, what counts as exposed and where the measurement has its limits.
Key facts
- Measured on 7 September 2026.
- Logs analysed: 10 August to 7 September 2026.
- Subject: 70 deployment secrets of one operator, stored in an encrypted configuration file (Ansible Vault).
- Data: every local session log of the AI coding agent Claude Code on the operator's workstation.
When a secret counts as exposed
A secret counts as exposed if its complete value appears unchanged, in plain text, in at least one log file. Fragments, encoded forms such as Base64 and bare key names do not count.
Procedure
- Take the 70 values from the encrypted configuration file.
- Hash every value, so that the result can name each one without its plain text.
- Compare every session log from the period against these values and record, for each value, the files it appears in.
- For every hit, determine the route by which the value got into the log.
Result
68 of the 70 secrets appeared in plain text in at least one session log, spread across 99 files. Only two values appeared in no log at all. Every hit goes back to one of four routes, and on each of them the value was part of the output of a tool the agent had run.
The four routes into the log
- An error message from the deployment tool wrote the complete set of configuration values into a traceback while resolving a reference.
- The encrypted configuration file was displayed fully decrypted for a check, instead of querying individual keys.
- A grep search ran over a decrypted copy of the file and printed the matching lines, values included.
- A merge conflict in the encrypted file was resolved by merging the versions involved in plain text.
What all four routes share: whatever a tool prints, the agent reads, and whatever the agent reads then stays in the session log on disk.
Limitations
- One operator, one machine, one agent: the figure describes this single case and is not a rate for other teams.
- Only the local logs were analysed. Whatever the model provider stores lies outside the measurement.
- Only unchanged values were counted. Encoded or split occurrences are missing, so further hits are possible.
- The measurement shows where a value sat in plain text, not whether anyone misused it.
- The measurement was carried out by the provider of Erseni Vault, a party with an interest of its own. It has not been reviewed externally.