An opsec gap I keep running into as more devs adopt AI coding agents: the agents keep local session history in plain text, and people routinely paste API keys, tokens, and .env values straight into prompts. Those secrets then sit on disk in the agent's history, outside the coverage of repo and CI secret-scanning. Claude Code keeps them under ~/.claude/projects, Codex under ~/.codex/sessions, and about 30 other agents do the same.

Your threat model probably already covers keys in git and CI. The workstation copy is the part that gets missed: a stolen laptop, a synced backup, or a shared machine exposes months of pasted credentials in readable logs.

I built a small MIT tool for the cleanup half of this, agent-sweep. It scans those local history files, reports what leaked, and can redact the values in place while keeping the file byte-for-byte so old sessions still resume. It makes zero network calls, so nothing about the scan leaves the machine. Detection is an Aho-Corasick pre-filter, then 193 regex rules plus a BIP-39 seed-phrase check.

One caveat so it is not oversold: this is residue cleanup, not a substitute for rotating a key that already hit a hosted model. Rotate first, then sweep the local trail.

Disclosure: this is my own project. Repo (MIT): https://github.com/Ishannaik/agent-sweep

Mostly I want to know how others here treat the workstation as part of the secret-scanning perimeter, or whether agent logs are still a blind spot in your setup.

I have read the rules.