Solutions
An agent read my API keys. What do I do now?
Rotate the credential first and investigate afterwards. Once a value has entered an agent's context it has been transmitted to the model provider and it is sitting in that conversation's history, so the only reliable remedy is to make the value worthless.
You have just noticed that an agent opened a .env, or printed a token into its own output, or that a command it ran echoed a value you never meant it to see. The instinct is to work out how bad it is before doing anything. That order is the wrong way round, because the cheap action is time-sensitive and the investigation is not.
Rotation is cheap, fast, and completely undoes the exposure. If the value ever reached a public repo, even for a minute, treat it as permanent: bots scrape freshly pushed commits within minutes, and a fork or a clone keeps its own copy long after you rewrite history to remove it. Analysis is slow and changes nothing about the risk while you are doing it. Work outward from blast radius rather than from likelihood: a key that can spend money, deploy, or read customer data goes first, and a read-only key for a public API can wait until you have dealt with those. Do not skip a key because the conversation was short or the agent seemed to ignore the file, because you cannot see what was in the context window and neither can the vendor's support team. Once the rotation is done, the question worth answering is not which agent did it but why a live value was somewhere an agent could reach at all.
How it works
- 1Rotate anything with spend, deploy or customer-data access, right now, before reading further.
- 2Rotate the rest in order of what they can reach. Assume every value in any file the agent opened is exposed.
- 3Check the provider's audit log for use you do not recognise, after rotating rather than before.
- 4Move the values into Vault so the next agent runs the command with the key instead of reading it.
- 5Replace the project's .env with placeholder names if something expects the file to exist.
Straight about the guarantee: Rotating is the only remedy that actually works. There is no way to retract a value from a model provider's conversation history, and any tool promising otherwise is selling you comfort rather than a fix.