The secrets that leaked into my AI transcripts mostly came back as tool answers, not as anything I typed. How that happened, and the tool that cannot return one.
On 23 September 2026, Claude moved two items in my password vault through a ready-made MCP server (a plug-in that lets the assistant call a tool). Every call answered with the whole item, password history and notes included. After the two folder moves, about a dozen plaintext passwords sat in one archived transcript.
Where the leaks came from
On 26 August a review searched my session archive and found 124 distinct secrets in 11,821 places across 431 files, some exposed for up to five months. A few I had pasted myself in July; most came back verbatim from tools. The lessons note of 2 September: “Secrets leak through tool results, not through prose.”
Three more, after the lesson
Even the day the lesson was written down, it happened again. That evening a helper agent of Claude’s traced a script with bash -x, which prints every command with its variables filled in, and three credentials landed in the output.
On 17 September I had Claude install Infisical, a self-hosted secrets manager, on my home server, Yavin*. Claude’s next vault search was too broad, and the connector returned all three new entries in full. Claude’s note: “That over-broad call was mine.” By a quarter to three a second generation was running, with fresh keys.
Rotate, do not redact
On 26 August Claude and I scrubbed the archive: 11,821 replacements. But my transcripts are kept on purpose, in snapshots and backups; a scrub cleans one copy. Rotation, replacing the credential at its source, makes every copy worthless at once; mine came in stages, through September.
The password that reached no machine
On 11 September at 17:41 I changed my mail password in Vaultwarden and updated my laptop, phone and tablet by hand. Five other copies, on three machines, kept the old one, and mail jobs failed about 1,400 times until Monday.
In July I had named Vaultwarden the source of truth for server secrets, but nothing read it: the distribution code assumed a feature Vaultwarden lacks, and nothing checked that deployed passwords still worked. The review’s first lesson: “A secret store nothing reads is documentation, not infrastructure.”
What Claude and I built instead
On 14 September, a distribution tool: a list of every deployed copy, values moved from vault to machine outside the chat, and a daily check of each copy, logging in where the service allows it. On 17 September, Infisical as a store for machines only, since a vault a person must unlock cannot feed night jobs. On 23 September, a vault tool for the assistant that prints only names, folders, types, dates and yes/no flags; tested against a decoy vault, it replaced the stock connector that day.
The pattern
Secrets by reference only, enforced by tools that cannot leak; rotate, do not redact. My rulebook had told the assistant since July not to print secrets; the tools’ answers carried them anyway. What held was a tool whose answer has no field for a value. Before connecting a tool, I now ask what the largest thing it can return is.
Not everything is solved. The guard against whole-item reads runs in Claude Code but, as we found on 23 September, not in the desktop app; there, the only protection is that the old connector is gone. Not every job uses the machine store yet.
Part 8 of twelve in the series on how I built my AI OS. Start with the preface.
Next: build supervised, run unattended — why the AI refused to work on my servers while I was away, and was right.
* Host names are changed (here: Yavin, my home server). The real ones come from a different saga.
Appendix — for builders
- Read a connector’s tool list before you install it. Ask what each call can return at most; a list or search that returns whole records will one day return a secret.
- Prefer a projection. A tool that prints a fixed set of fields cannot leak a field it lacks. Test it against a decoy vault of fake values.
- Move values machine to machine, never through the chat. The assistant needs names and results, not values.
- Never trace a script that loads secrets.
bash -xandset -xprint expanded variables. - Count and list the copies before you rotate, and check daily that each still works.
- Scan your transcript archive on a schedule, reporting the place, not the match.
- Rotate, do not redact. Archives and backups are immutable on purpose; a credential replaced at its source makes every copy useless.
- What I considered instead: the stock connector with stricter rules (the rule broke three times); the password manager’s own cloud secrets service (machine secrets with a US provider, against my move to European infrastructure); its self-hosted edition (an enterprise licence, and leaving Vaultwarden); Vaultwarden with the distribution tool alone (needs a person to unlock). I chose a metadata-only vault tool plus self-hosted Infisical: the one combination that runs unattended on my own hardware.