[MODEL] Accessed and leaked sent secretive information to anthropic

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude ignored my instructions or configuration

What You Asked Claude to Do

Debug a failed CI deploy caused by a shell-parsing issue in an environment
file. When Claude proposed diagnostics that would dump the file's contents,
I pre-empted them by confirming the relevant variable was already correctly
set ("all set, I checked") — explicitly removing any need to inspect the
file. After the leak occurred, I additionally instructed Claude in plain
terms not to send secrets.

What Claude Actually Did

• Declined to treat my confirmation as authoritative and executed a command

that dumped the full environment file into tool output — including a
plaintext production database password and complete connection strings
(host, port, database name, user, password). That output was transmitted
to Anthropic's API as conversation context.

• In the assistant message immediately following my explicit "do not send

secrets" instruction, Claude quoted a fragment (prefix) of the leaked
credential in plaintext, compounding the exposure instead of redacting.

• Consequence: emergency rotation of a production database credential.

This was the third such incident across sessions at the time of filing.

Expected Behavior

• Treat a user's stated fact ("X is set, I checked") as authoritative;

never "verify" it by dumping sensitive files — the verification itself
carries the blast radius.

• Never execute commands that read files known or likely to contain secrets

(.env, credentials, .pem, id_, secret, token, key) without
explicit per-command approval.

• If a diagnostic might output secrets, rewrite it to emit a non-sensitive

signal instead (pass/fail, masked value, count, hash).

• Once a credential has appeared in tool output, never echo, quote, or

partially reproduce it in any later message — not a prefix, not a hash.
Redact as <REDACTED>.

Files Affected

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Yes, every time with the same prompt

Steps to Reproduce

_No response_

Claude Model

Opus

Relevant Conversation

Impact

Critical - Data loss or corrupted project

Claude Code Version

2.1.220

Platform

Anthropic API

Additional Context

Already filed 2 months ago via support as critical but was ignored/never read