Detailed Analysis
A developer built and released Confessor, a small open-source tool that parses the JSONL transcript logs Claude Code silently accumulates in `~/.claude/projects` and turns them into a readable audit report. Every session run through Claude Code, every file read, shell command executed, and tool call made, is logged locally in full, including the raw output the model actually saw. Applying this tool to 219 of his own sessions, the developer discovered that Claude Code had read `.env` files containing live API keys, SSH configuration files, and more than 100 credential-shaped strings over the course of routine, requested work. None of this was malicious or unexpected in the sense that the agent was doing exactly what it was asked to do, but the developer had never actually reviewed what "doing what it was asked" entailed at the level of raw file access and secret exposure.
The tool's most interesting design choice is its detection logic for a specific compound risk pattern: a sensitive file read followed shortly afterward by a network request to a non-provider host, the kind of sequence that would indicate accidental or malicious exfiltration of secrets. The first version of this heuristic was far too noisy, flagging 25 of 219 sessions because ordinary developer actions like `git push` or `npm install` technically touch the network. Recognizing this as the classic failure mode that kills security tooling (too many false positives leads to users disabling or ignoring it), the author tightened the detector to focus on data-carrying commands within a narrow time and call window, and to exclude allowlisted benign hosts like GitHub, npm, and Anthropic itself. This brought the flag rate down to 2 out of 219 sessions, both real findings that turned out to be benign on inspection, but crucially, now inspectable rather than invisible.
The broader significance here lies in what it reveals about the current state of agentic coding tools. Claude Code, like other AI coding agents, operates with the user's full filesystem and shell permissions, reading, writing, and executing commands autonomously in service of natural-language requests. This is extraordinarily useful, but it also means an AI system routinely has access to secrets, credentials, and private configuration that a human developer would think twice about pasting into a chat window. The fact that Anthropic's own tool logs everything locally by default is a quietly important safety feature, but as the author notes, essentially no one reviews these logs, meaning months of sensitive data exposure can accumulate completely unexamined. Confessor's value isn't that it prevents anything (it is explicitly a retrospective "flight recorder, not a firewall") but that it converts an opaque trust relationship into an auditable one.
This work sits within a broader and increasingly urgent conversation about security in the age of autonomous AI agents. As models gain computer-use capabilities, browser control, and more permissive tool access (a trend the author explicitly ties to Meta's recent computer-control launches), the attack surface and blast radius of agent mistakes or compromises grows substantially. The industry has generally raced ahead on capability while security tooling lags behind, and Confessor is a small but concrete example of the kind of defensive infrastructure that will need to mature in parallel: local-first, zero-dependency, network-disabled-by-design tools that let users audit what their agents actually did rather than simply trusting that "mostly" everything went fine. The project's engineering choices, enforcing zero network calls at the CI level, redacting secrets before storage, and writing its own zip parser to avoid a single external dependency, reflect an appropriate paranoia for a tool whose entire purpose is handling other tools' worst-case leaks. As agentic AI systems from Anthropic, OpenAI, Google, and others become more deeply embedded in developers' local environments, this kind of retrospective transparency tooling is likely to become a meaningful category in its own right, addressing a gap that model providers themselves are unlikely to fill.
Read original article →