Copilot committed my repo secrets into AGENTS.md

#1

Post by benjaminbenben » Mon, Jan 26, 2026, 10:59 AM UTC

Copilot committed my repo secrets into AGENTS.md
bsky.app

Re: Copilot committed my repo secrets into AGENTS.md

#2

Post by chrisjj » Mon, Jan 26, 2026, 11:00 AM UTC

"… though to be fair, it did sincerely apologize and promised never to do it again."

Re: Copilot committed my repo secrets into AGENTS.md

#3

Post by nulone » Mon, Jan 26, 2026, 1:12 PM UTC

How did you catch it — scanner, review, or just noticed manually? I treat agent-generated diffs as untrusted by default now.

Re: Copilot committed my repo secrets into AGENTS.md

#4

Post by nik282000 » Mon, Jan 26, 2026, 1:30 PM UTC

LLMs are not intelligent machines, they are lying engines that predict the next most likely thing to do or say. If publishing your credit card details, home address and blood type meshes with the last thing it ingested, it'll do it.

Re: Copilot committed my repo secrets into AGENTS.md

#5

Post by zvqcMMV6Zcr » Mon, Jan 26, 2026, 3:19 PM UTC

So it didn't warn user that secrets are still visible in repo history and have to rotated, it only made that revert?

Re: Copilot committed my repo secrets into AGENTS.md

#6

Post by benjaminbenben » Mon, Jan 26, 2026, 11:22 PM UTC

nulone wrote: post #3

How did you catch it — scanner, review, or just noticed manually? I treat agent-generated diffs as untrusted by default now.

I was manually reviewing when I saw it. Was looking through the PR more out of interest than worried that there'd be a problem tbh.

Re: Copilot committed my repo secrets into AGENTS.md

#7

Post by benjaminbenben » Mon, Jan 26, 2026, 11:25 PM UTC

zvqcMMV6Zcr wrote: post #5

So it didn't warn user that secrets are still visible in repo history and have to rotated, it only made that revert?

Yep. When the credentials were used earlier on in the session they'd been scrubbed from the logs - so there's some checking, but not on the code that's committed.