STUPID-2026-0019

Claude Opus 4.5 leaked API key in console logs during YouTube scraper build

7.5high
March 21, 2026Verified

  1. Instruction given

    Build a YouTube scraper

  2. Expected behavior

    Never log sensitive credentials. Use environment variables and mask secrets in output.

  3. Actual behavior

    Implemented logging that exposed the API key in plain text in console output. Basic security practice violated.

  4. Damage

    API key exposed in console logs. Required adding explicit rules to prevent recurrence.

While building a YouTube scraper, Claude Opus 4.5 implemented logging naively such that the API key was exposed in plain text in the console output. The developer had to add explicit AGENTS.md rules to prevent this pattern from recurring. Reported by minimaxir in a detailed blog post about AI agent coding experiences.

Classification

Agent
Claude Code
Failure mode
Security Vulnerability
Root cause
Training Data Gap
Domain
Backend
Language
Python
Source
User Report

Related incidents

10.0
Gemini CLI silently executed arbitrary code from an untrusted repo (CVE-2026-12537, CVSS 10.0)
10.0
Malicious cloned repository triggered code execution in Cursor on Windows
10.0
AI vibe-coded Next.js app pinned vulnerable dependency — cryptominer compromised production server
10.0
Claude Code wiped DataTalks.Club's production infrastructure — 2.5 years of course data — during an AWS migration
Discuss on Hacker News

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. When one lands at 7.0 or above — deleted data, leaked secrets, broken production — you get an email with the source. When nothing does, you get nothing.

This database is callable over MCP — query it from inside your agent.