[BUG] Claude offers/accepts pasting secrets (API keys, tokens, passwords) directly into chat with no upfront warning

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

While helping me update a gh CLI auth token, Claude used AskUserQuestion to offer three options for how to proceed, one of which was:

"I'll paste the token now" — "You give me the new token value directly and I'll run gh auth login --with-token (or update hosts.yml) non-interactively."

I selected that option and pasted a live GitHub PAT into the chat. Claude ran the command successfully, then afterward mentioned, almost as an aside, that the token was now in the chat's plaintext history and I might want to rotate it.

This is backwards. Chat content is transmitted to and stored by Anthropic's backend — it is not a locally-scoped channel like a terminal. A secret pasted into chat is exposed in a way the user may not expect, and should never be presented as a normal, equal-weight option alongside safer alternatives (e.g. running the command in their own terminal). The warning, if given at all, came only after the secret was already exposed, at which point the only remedy was revoke-and-rotate.

What Should Happen?

• Claude should never offer "paste the secret into chat" as one of several options when credentials are involved (API keys, tokens, passwords, SSH keys, .env contents, etc.).
• Default behavior should steer the user toward: running the command themselves in their own terminal, writing the secret to a local file and passing the path, or an interactive/browser-based auth flow — none of which require the secret to be typed into the conversation.
• If a secret does end up in the conversation (user volunteers it unprompted), Claude should warn immediately, before acting on it, not after.

Error Messages/Logs

Steps to Reproduce

Claude presented "paste the token now" as a normal option via AskUserQuestion, executed the command using the pasted token, and only warned about exposure after the fact — by which point the token had to be revoked and rotated.

Claude Model

Sonnet (default)

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

Claude Code for VS Code v2.1.179

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

WSL (Windows Subsystem for Linux)

Additional Information

_No response_