Your AI Agent Has Your API Keys (And So Does Every Other Agent)

Open your Claude Code settings.json. Look at the env blocks under your MCP servers. Every API key, every database token, every webhook URL you've put there — your agent has all of them, right now, in its process environment. That might sound obvious. You configured it that way. But think about what