You pasted your API key into a chat to debug a 401 error, the agent ran the test, and you closed the window. You think you are clean, but you are wrong. According to developer Gabriel Anhaia, a single agent session can scatter your secret across eight distinct locations on your machine and in your cloud repositories. The problem isn't just that the key is exposed; it's that standard cleanup habits fail to account for the persistent nature of modern AI coding tools.

The Local Blast Radius

The first layer of infection is local. Your shell history is the obvious culprit; if you exported the variable directly, it is sitting in ~/.bash_history or ~/.zsh_history. But the agent itself is a bigger leak. Claude Code writes plaintext transcripts to ~/.claude/projects/, storing every prompt and tool output, including that pasted key. Codex does the same under ~/.codex. These files persist for 30 days by default unless you explicitly purge them. Even terminal scrollback in tmux panes can hold the secret if the agent printed environment variables during execution.

Repository and Cloud Contamination

The contamination spreads beyond your local disk. If the agent wrote the key into a test fixture or a .env file that got committed, it is now in your Git history. Tools like gitleaks can scan the filesystem, but git log -S is required to find it in past commits. Furthermore, MCP server configurations often hardcode tokens in ~/.claude.json or .mcp.json. These files are frequently synced or shared, meaning your secret might be sitting in a config file waiting to be pushed to a remote repository.

The Ghost in the CI and PRs

Perhaps the most insidious leaks happen in the cloud. GitHub Actions masks registered secrets, but if an agent hardcodes a key into a failing test, that key appears in plain text in the CI logs. GitHub's documentation warns that redaction is not guaranteed for unregistered secrets. Similarly, pasting a screenshot of a failed request into a Pull Request comment can expose the key in the image. These artifacts persist in logs and comments long after the code is merged, accessible to anyone with read access to the repository.

Immediate Remediation Protocols

Before you start grepping through files, revoke the compromised key immediately. As GitHub’s guide on leaked secrets suggests, rotation is the primary defense because a revoked key is useless, regardless of where it sits. Once rotated, use the tail of the old key to search for remaining instances. Use read -rs to input the search string into a variable to avoid adding a ninth copy to your shell history. Check your memory files, such as CLAUDE.md, where agents may have saved the key as a project rule for future sessions.

Key Takeaways

  • Revoke and rotate the API key before attempting any cleanup or history rewriting.
  • Agent transcripts in ~/.claude and ~/.codex persist for 30 days by default and must be purged.
  • CI logs only mask registered secrets; hardcoded keys in test failures are visible in plain text.
  • Screenshots in PR comments can leak keys, and edit history may retain old revisions.
  • Use read -rs to search for the key without adding the search string itself to your history.

The Bottom Line

Revocation is the only true fix; treat every agent session as a potential leak vector and audit your memory files, CI logs, and transcripts before assuming your keys are safe.