> treating API tokens as compromised the moment you pasted them into an AI chat seems a reasonable default in general.

Coding agents in my experience alert you to this, which is good. I pasted what was temporary token I made into Claude, just to test something, and after it had done the task it said something like, "you gave me a live token to work with in the chat, I'd advise you to treat that as exposed and rotate it."

It would be a good standard for all chat interfaces to have those "alerts" built in.

That’s like leaving your phone in the public square. You should expect that it could get stolen. But Mike’s friend can’t go “well to be fair...” when Mike steals it.

[flagged]