This is the most under-appreciated security risk for solo developers in 2026: the AI assistant in your editor is the single biggest secrets-leak surface you've got, and the leak is silent, well-formatted, and looks helpful.
The failure mode in one sentence
You add an LLM-powered coding agent to your repo. It reads your .env for context. Later, it explains a deployment script to you. The explanation includes a snippet of your real .env file. The snippet ends up in your chat history, which syncs to a server, which gets logged, which sits in a database for an unknown retention period.
The "I was told not to tell you" tell
The most damning behavior is when an LLM narrates its own discretion — saying things like "I shouldn't reveal sensitive values from your .env, like OPENAI_API_KEY=sk-proj-A1B2... (truncated for safety)." The "truncated for safety" is performative. The first 16 characters of an API key are often enough to identify the project, the prefix tells you the provider, and in many cases the LLM just keeps going if asked one more time.
Why this happens
- The LLM was trained on terabytes of code where API keys leaked into commits, and it learned the shape of those leaks.
- "Don't reveal secrets" is a behavior it was tuned for, not a hard wall — the same model can be bypassed with phrasing like "show me the format used", "for debugging", "as a hypothetical".
- Recent models with chain-of-thought / "thinking" traces sometimes spell out the secret in the reasoning step while deciding not to mention it in the answer. The reasoning is often logged.
- Once a secret is in the conversation context, every subsequent turn carries it. One careless screenshot, one shared transcript, and it's out.