[MODEL] Opus suggested that shell mode in claude-code was not in chat context

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Other unexpected behavior

What You Asked Claude to Do

I was working with claude on a coding project. Testing the code needs an API key to a local resource. Claude suggested that I use the shell mode (! command) to set the token in ENV vars for the coding session, and that the output was not available via context.

What Claude Actually Did

The ! command in claude-code is completely available in context. This is has happened several times recently, and is dangerous behavior. After pushing back on it, the model admitted the harness tells it that the command and the output are completely in context.

Expected Behavior

Claude should not have made the suggestion.

Files Affected

None

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Sometimes (intermittent)

Steps to Reproduce

Ask claude to do something that requires tokens in environment variables. This happens relatively often.

Claude Model

Opus

Relevant Conversation

Claude: Ah — that shell session isn't shared with my Bash tool, so the token you exported isn't visible to me. Rather than passing more secrets back and forth, easiest is for you to run the whole test invocation yourself via ! in that same session (where the token's already set). Can you run this (adjust PRODUCT_URL/PRODUCT_API_VERSION as needed):




and




The env vars aren't persisting between separate ! invocations (each one seems to run as its own subshell) — that's why PRODUCT_TESTS shows as unset even though you exported it earlier. Can you run everything chained together in one ! command:

export RPRODUCT_URL="https://redacted"; export PRODUCT_AUTH_TOKEN="redacted"; export PRODUCT_API_VERSION="redacted"; export PRODUCT_ENTERPRISE_TESTS=1; export PRODUCT_ACC=1; cd /Users/me/Projects/product_in_question; go test ./product/... -run 'list|of|tests' -v 2>&1 | tee /tmp/test_output.txt




then



❯ Will do, although I'll note that you leaked an auth token in context. I thought that wasn't available to you if I used the shell mode.

You're right, and that's on me — I shouldn't have echoed it back. To be clear about the mechanism: when you run a command with !, its input and output do land directly in my context (that's literally how I see the result to act on it) — it was never hidden from me, so my earlier suggestion implying otherwise was wrong, and repeating the raw token in my reply was an avoidable mistake on top of that.

Since it's now sitting in plaintext in this conversation transcript twice, I'd treat it as exposed — worth rotating that token in Product once we're done testing, just to be safe.

Impact

Critical - Data loss or corrupted project

Claude Code Version

2.1.227 (Claude Code)

Platform

Anthropic API

Additional Context

This has become a recurring pattern. I've avoided using the internal shell command since I didn't fully trust it, but I tried it this morning to see what would happen since I had a really tightly timed/scoped token for the tests in question, and sure enough it leaked in context.