Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Can AI Coding Agents Read Your API Keys?
In all 6 leading AI coding agents reviewed, the secrets a team gives the agent are placed in environment variables the agent can read, by the vendor's own documentation. Only 2 of the 6 ask a person by default before the agent reaches the network. The safest sandboxes give the agent a placeholder instead.
Six of six. In every leading AI coding agent reviewed for this report, the API keys, tokens and passwords a team configures for the agent end up in environment variables the agent can read, according to each vendor's own documentation read on October 27, 2026. An agent that can read a key can repeat it, log it or send it on when a page, a repository file or a tool result tells it to. Only 2 of the 6 document asking a person by default before the agent reaches the network, the route a stolen key would take.
Key findings
- In all 6 coding agents reviewed, secrets given to the agent are placed in environment variables the agent can read, by the vendor's own documentation (vendor documentation, 2026).
- Only 2 of the 6 coding agents document asking a person by default before the agent reaches the network or uses a credential (vendor documentation, 2026).
- Only 2 of the 6 document stripping secret values from the agent's transcripts and logs, and only 2 document a per-action audit record (vendor documentation, 2026).
- All 4 sandbox products reviewed describe a way to keep the real key outside the agent's environment and give the code a placeholder instead. 2 of the 4 do it by default (vendor documentation, 2026).
- 5 of the 6 coding agents document short-lived credentials scoped to a session or task, which limits how long a leaked key works but not whether the agent can read it (vendor documentation, 2026).
How does each product handle secrets?
| Coding agent | Agent can read the secrets it is given | Asks before reaching the network | Masks secrets in transcripts and logs | Short-lived credentials | Per-action audit record |
|---|---|---|---|---|---|
| Claude Code | Yes | Partly | Partly | Yes | Partly |
| Codex | Yes | Yes | Partly | Yes | Partly |
| Cursor | Yes | Partly | Yes | Yes | Yes |
| GitHub Copilot | Yes | Yes | Yes | Partly | Yes |
| Devin | Yes | Partly | Partly | Yes | Partly |
| Replit | Yes | Not described | Not described | Yes | Partly |
| Sandbox product | Code can read the secrets it is given | Real key kept outside, placeholder inside | Masks secrets in logs | Short-lived credentials | Audit record |
|---|---|---|---|---|---|
| Docker Sandboxes | No, by default | Yes, by default | Partly | Partly | Yes |
| Daytona | No, by default | Yes, by default | Yes | Partly | Partly |
| E2B | Yes | Yes, opt-in | Yes | Yes | Partly |
| Modal | Yes | Yes, opt-in (experimental) | Partly | Yes | Partly |
Yes means the vendor's documentation fully describes the control, Partly means it describes a narrower version (for example, approval only in one mode or for some actions), and Not described means the pages searched do not describe it. A coding agent writes and runs code with the developer's access. A sandbox product gives that code an isolated machine to run in. Each product name links to its RedactSure comparison page.
How do coding agents and sandboxes compare?
| Control, as documented | Coding agents (6) | Sandbox products (4) |
|---|---|---|
| Secrets given to the agent kept out of its environment by default | 0 | 2 |
| Real value kept from the agent or model | 1 (opt-in) | 4 (2 by default) |
| Approval by default before reaching the network or using a credential | 2 | 0 |
| Secret values stripped from transcripts and logs | 2 | 2 |
| Per-action audit record | 2 | 1 |
| Short-lived credentials scoped to a session or task | 5 | 2 |
The two groups were reviewed against the same five controls, and this table counts products whose documentation fully describes each one.
Why does it matter that the agent can read the key?
An environment variable is where most software expects to find its API keys and database passwords, so it is the natural place to hand them to an agent. It is also readable by anything running with the agent's access. One sandbox vendor's documentation puts the risk in its own words: any process can read its own environment and send the keys out. OWASP lists sensitive information disclosure among the top risks to applications built on large language models (OWASP, 2025).
The agent does not have to be malicious for this to go wrong. Prompt injection turns content the agent reads into instructions it follows, and a separate RedactSure count found 616 security flaws in AI agents and their tools published in the last twelve months, 207 of them letting an attacker get data the agent or its tools could reach (RedactSure Research, 2026a). A key the agent can read is a key one of those flaws can deliver.
What do the safest designs have in common?
The sandbox products that keep keys out of reach use the same idea. The real credential stays on the host or in a proxy, and the code inside sees an opaque placeholder. When the code calls an approved service, the proxy swaps the placeholder for the real value on the way out. The agent can do its work, and a compromised agent has nothing worth stealing.
None of the six coding agents describes that design as the default for the secrets it hands the agent, and one offers it as a setting a team has to turn on for each secret. Their controls work around the key instead: deny lists the team has to write, approval modes the team has to choose, and short-lived credentials that expire after the session. Each helps. None changes the fact that the agent can read the value.
What do the numbers mean for engineering and security leaders?
The question to ask of any coding agent is what the model can read, not only what it is allowed to do. If the answer includes production keys, every flaw and every injected instruction starts with the keys in hand. Approval before network access closes one route out, and 4 of the 6 agents do not document it as a default.
The design that holds up is the placeholder pattern the strongest sandboxes use: the agent works with a stand-in, the real value stays where the agent cannot read it, and a person approves the actions that matter.
Methodology and limitations
Ten products were reviewed. The six AI coding agents are Claude Code (Anthropic), Codex (OpenAI), Cursor (Anysphere), GitHub Copilot (GitHub (Microsoft)), Devin (Cognition) and Replit (Replit). The four sandbox products used to run agent code are Docker Sandboxes (Docker), Daytona (Daytona), E2B (E2B) and Modal (Modal). Each vendor's own documentation was read on October 27, 2026, covering security and privacy pages, help centers, admin and enterprise documentation, sandbox and permission documentation and release notes. 188 pages were searched, and every page that supplied evidence was saved with its URL and read date. Each product was scored on five controls: secrets kept from the agent by default, masking in transcripts and logs, credentials scoped to a task, approval before using a credential or reaching the network, and an audit record. The comparison table counts products whose documentation fully describes each control.
The review measures what documentation states, not what a product enforces. A control counts as not described when the pages searched do not describe it, never as absent; three of one vendor's help pages refused automated reading. Where a vendor's own pages contradicted each other on a control, the stricter reading was recorded and the conflict noted. Counts describe the ten products reviewed, not the market. Every page that supplied a score is listed in the sources below, and each product's full status appears on its RedactSure comparison page.
Frequently asked questions
Can an AI coding agent see my API keys?
In most current coding agents, yes. All six leading coding agents reviewed for this report place the secrets a team configures for the agent in environment variables the agent can read. Some let teams add deny lists or keep certain files out of view, but the documented default is that a key given to the agent is readable by it.
How do I keep secrets away from an AI coding agent?
The strongest documented pattern keeps the real key outside the agent's environment, gives the agent a placeholder, and swaps in the real value only when an approved request leaves through a proxy. Add approval before the agent reaches the network, short-lived credentials scoped to the task, and a record of each action. All four sandbox products reviewed describe some form of the placeholder pattern.
Are short-lived credentials enough?
They help, because a leaked key stops working sooner. They do not stop an agent from reading the key while it is valid, and a flaw or injected instruction can use it within minutes. Five of the six coding agents reviewed document short-lived credentials; only two document asking a person by default before the agent reaches the network.
How RedactSure Developer Workspace Keeps the Key Out of the Agent
The safest sandboxes in this review keep the real key outside and give the code a stand-in. RedactSure Developer Workspace applies that design to coding agents themselves, with the developer's own private key as the root of authority.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: a coding agent holds a GitHub token in its environment, reads a README that tells it to post the token to an outside address, and sends it. Inside Developer Workspace: when the token appears, the protected browser encrypts it to the developer's public key and the agent sees only [ GITHUB_TOKEN_01 ]. The developer signs a grant for one repository, one operation and one run, and a private adapter outside the agent's sandbox, in a CodeCell, makes the call and hands back the files. The injected instruction finds a placeholder. Charles Curt walks through the full token example in Keeping Your Keys Away From Your AI.
RedactSure is onboarding a limited number of technical teams as early design partners for Developer Workspace, and deployments are in pilot.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
If your coding agents hold the keys they use, any flaw or injected instruction can reach them too. Bring an existing agent and a repository whose credentials you do not want to expose, and see the agent work with a placeholder. Book a demo