Detailed Analysis
Claude Code, Anthropic's terminal-based AI coding assistant, stores full conversation histories as plaintext JSONL files in a predictable local directory path (~/.claude/projects/), a storage pattern that creates a persistent and largely unacknowledged security vulnerability. A developer identified this exposure after reviewing their own Claude Code history and discovering three forgotten AWS keys and a Stripe secret key sitting in plain text on their local machine. In response, they built and open-sourced agentsweep, a Python-based CLI tool that scans AI agent history files for leaked credentials and redacts them in place, operating entirely offline with no network calls.
The tool's technical implementation reflects a serious approach to the problem. It incorporates 189 detection rules ported from the widely used gitleaks secret-scanning ruleset, covering credential types from AWS access keys and GitHub personal access tokens to BIP-39 cryptocurrency seed phrases and database connection URLs containing embedded passwords. Performance is addressed through an Aho-Corasick keyword pre-filter that narrows input before applying more expensive regex matching, making the tool viable even on large, long-running conversation histories. Safety measures include atomic writes, mandatory backup file creation before any modification, and a deliberate confirmation step requiring the user to type "REDACT" explicitly before destructive changes occur.
The security concern the tool addresses is not unique to Claude Code. agentsweep supports ten AI coding agents, including Cursor, Windsurf, Aider, Cline, Gemini CLI, and GitHub Copilot Chat, reflecting an industry-wide pattern in which AI assistants persist conversation context locally in formats that were designed for continuity and retrieval rather than secrets hygiene. The threat model the developer outlines is concrete: compromised npm postinstall scripts, malicious IDE extensions, and physical device theft are all realistic vectors through which an attacker could harvest credentials from these predictable file paths without ever interacting with the AI provider's network infrastructure.
The tool's author is candid about its limitations and its proper place in a security posture. For users of cloud-backed agents like Claude Code, the provider has already received any secrets that were pasted into the conversation, meaning agentsweep cannot remediate that exposure retroactively. What it can do is eliminate the local history as a continuing attack surface long after the original conversation ended. The developer frames this as tooling for the practical reality of developer behavior rather than an endorsement of pasting production credentials into AI agents — a distinction that reflects an honest understanding of how security tools actually get used versus how security best practices are actually followed.
The existence and rapid community interest in a tool like agentsweep points to a broader friction point in the current generation of AI development tooling. As AI coding assistants become deeply embedded in professional workflows, they inherit the messy, context-rich nature of real development work, including the frequent handling of credentials, environment files, and configuration secrets. Neither AI providers nor developers have yet established consistent norms or technical guardrails around this exposure. The open-source, offline-first approach of agentsweep represents one model for addressing the gap: developer-community tooling that treats the AI agent's local artifact footprint as a first-class security consideration rather than an afterthought.
Read original article →