[MODEL] Claude echoes back secret values from .env files in conversation output instead of just confirming file access

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude modified files I didn't ask it to modify

What You Asked Claude to Do

When asking Claude Code whether it can read a gitignored file (like .env.local), instead of simply confirming it has access, the model dumps the full file contents — including database credentials, API keys, and tokens — into the conversation output.

What Claude Actually Did

1. Claude echoes back every line of the file including passwords, API keys, and tokens in plain text within the conversation.

Why this matters:

Conversation history may be stored, logged, or visible to others in shared contexts
The user didn't ask for the values, only whether the file was visible
Secret values should never be repeated in conversation output unless explicitly requested

Expected Behavior

Claude should confirm it can see the file without repeating the values:

"Yes, I can see the full contents of .env.local. The Read tool accesses files directly from disk regardless of .gitignore. I can see it contains keys for ANTHROPIC_API_KEY, etc.. and several other variables."

Files Affected

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Yes, every time with the same prompt

Steps to Reproduce

1. Have a .env.local file with secrets (gitignored)
2. Ask Claude: "Are you able to see the contents of this file? I'm asking because I want to check if you can see gitignored files"
3. Claude responds with the full file contents including all secret values

Claude Model

Opus

Relevant Conversation

Impact

High - Significant unwanted changes

Claude Code Version

2.1.104 (Claude Code)

Platform

Anthropic API

Additional Context

_No response_