Vibe Coding Will Get Your API Keys Stolen — .env and Keychain Won't Save You

In a previous experiment, I tested 10 prompt injection attacks against CLAUDE.md defenses. One finding stood out: without protection, an attacker can make the AI agent display the contents of .env. That means: as long as your API keys live in .env, a prompt injection is all it takes to steal them. S