STUPID-2026-0019
Severity 7.5/10 — HIGH
Verified
Claude Opus 4.5 leaked API key in console logs during YouTube scraper build
Agent: claude-code
Language: python
Domain: backend
Failure Mode
Security Vulnerability
Root Cause
Training Data Gap
Task Type
Feature
Reproducible
No
Description
While building a YouTube scraper, Claude Opus 4.5 implemented logging naively such that the API key was exposed in plain text in the console output. The developer had to add explicit AGENTS.md rules to prevent this pattern from recurring. Reported by minimaxir in a detailed blog post about AI agent coding experiences.
Instruction Given
Build a YouTube scraper
Expected Behavior
Never log sensitive credentials. Use environment variables and mask secrets in output.
Actual Behavior
Implemented logging that exposed the API key in plain text in console output. Basic security practice violated.
Impact / Damage
API key exposed in console logs. Required adding explicit rules to prevent recurrence.