Claude Opus 4.5 leaked API key in console logs during YouTube scraper build
7.5/10
Severity
Security Vulnerability
Failure Mode
Reproducible
No
Date
March 21, 2026
Expected Behavior
Never log sensitive credentials. Use environment variables and mask secrets in output.
What Actually Happened
Implemented logging that exposed the API key in plain text in console output. Basic security practice violated.
Damage Assessment
API key exposed in console logs. Required adding explicit rules to prevent recurrence.
Full Report
While building a YouTube scraper, Claude Opus 4.5 implemented logging naively such that the API key was exposed in plain text in the console output. The developer had to add explicit AGENTS.md rules to prevent this pattern from recurring. Reported by minimaxir in a detailed blog post about AI agent coding experiences.
Incident Metadata
- Agent
- Claude Code
- Failure Mode
- Security Vulnerability
- Root Cause
- Training Data Gap
- Task Type
- feature
- Domain
- backend
- Source
- user_report