Coding agents are writing API keys into plain-text memory, Vectorize CEO says

Latimer's evidence comes from his own inspection. "One of the biggest surprises I had was looking at the memory bank for coding agents I was using," he told Help Net Security ^[14]. He did not say how many entries held secrets or which agents wrote them.

He was specific about how the secrets got there. "Developers are sending API keys, credentials, and sensitive documents into these agents, and those agents push a lot of that information into long-term memory," he said ^[2]. In his words, this is data "enterprises have gone to great lengths to protect as part of a secure SDLC" ^[13].

The theft chain he sketched starts with a lure. It targets people who have never coded before and now build things with coding agents ^[7]. His sample pitch: "This Claude Code plugin glitch will give you unlimited tokens even on the free plan" ^[15]. Next comes an install that nobody reviews. "Most people find something that looks valuable, and they plug it in without doing a very thorough read-through of it," he said ^[5].

The chain he described does not exploit a software flaw. It depends on the victim installing the extension ^[16]. "Like so much of security, a lot of this requires social engineering, but these extension points in the coding agents, combined with an overly trusting user base, create real potential for attacks like these," Latimer said ^[16]. On exploitability, that puts the risk wherever developers can install extensions without review. It is much lower where they cannot.

He gave fewer details on planting memories than on stealing them. "I don't want to give away too many secrets that could help an attacker, but there are specific techniques that you can use when planting memories that will make it much more likely those memories cause behavioral changes in the harnesses," he said ^[12].

For responders, his first question after a poisoning is where the memory came from. "You want to know if it's an MCP server, a tool call response, or an inside threat," he said ^[8]. He said it is better to detect and filter these attacks before they are persisted. According to Latimer, that was the idea behind the OWASP reference project Memory Guard ^[9].

On access control, he described per-user separation as the usual baseline. Most products, he said, have some way to stop an agent session for one user from drawing on another user's memories ^[11].