Customer live demo: Let’s Stop Your AI Agents Sprawling Production Keys.

Every developer now works with a coding agent that reads files, runs commands, and calls APIs on their behalf.

Ask it to run a test that needs a production credential, and it does the sensible thing: it fetches the key from your vault and finishes the task. Along the way, it also:

• Writes that key in clear text into a transcript file on the laptop, ready for attackers to collect
• Sends it to the model provider

Nobody pasted anything. Nobody did anything wrong. Your agents just lacked guardrails.

What you'll see live

• A routine prompt in Claude Code
• The key landing in the agent's memory file
• The finding surfacing in GitGuardian as a valid key
• Why scrubbing the file afterwards is not the fix

Then, one command later (ggshield machine setup), the same prompt gets blocked and the key never reaches the model.