Vibe Coding
Pattern: Coding Agents Are Hardening the Credential Egress Path, Not Just the Tool Boundary
Three separate fixes in one 48-hour window all guard what leaves the machine rather than what the agent may call. Claude Code 2.1.248 stopped cloud sessions uploading editor swap and backup copies of credential files; Cline v4.1.16 now redacts credentials embedded in git remote URLs from the workspace information sent to the model; SiYuan's CVE-2026-82233 is an agent being induced to upload SSH keys from outside the workspace. Permission allowlists cover the call, not the payload, and the payload is where secrets actually escape.
↳ Follow the thread