Everyone in this room has pasted something they shouldn't have. A stack trace with a customer's email in it. A config file, to ask why the connection fails. A few rows of production data, because the bug only happens with real data. You did it because it was the fastest way to get an answer, and it worked.

The useful question is not whether that was careless. It's mechanical: **your agent has read access to everything and write access to your repository.** That is the shape of an exfiltration path, and it does not require anyone to be malicious. So let's trace it properly, in three parts, with a synthetic marker we can follow. I build a SaaS for law firms entirely with a coding agent, where a leak is professional secrecy, so I had to answer this for real.

**Ingress — more went in than you pasted.** You sent a stack trace; the harness opened the file, and the file opened the config beside it. You asked it to fix a query; it read the dump you had left in the working directory to reproduce the bug. The effective context is assembled by your tooling, not by your message, and almost nobody has looked at the actual request body their agent sends.

**Persistence — the copies outlive the session.** The provider's context is one destination, governed by whatever retention your tier and contract actually specify, which is a different question from training and worth separating carefully. Your own agent traces are a second, and they capture tool returns in full because body capture defaults to on and the default was chosen before your first sensitive call. The prompt cache is a third. Your CI logs are a fourth, and they are usually the least protected of the four.

**Egress — three ways it leaves, only one of which people watch.** Generated artifacts are the permanent one: the agent reproduces what it read into fixtures, docs, comments and commit messages, and once that is committed, deleting the file does not remove it from history. The second is injection: a dependency's README, an issue body, a scraped page or a tool result can carry instructions, and an agent holding your data plus any network-capable tool is a delivery mechanism. The third is simply the next session, and the next engineer.

Then the boundary. Everything below runs in our CI today:

- **Fixtures must declare themselves fake or they are refused at load time.** A test double that claims to be production-certified is rejected by the contract. Unmarked data does not get to be trusted by default.
- **Seed data is fake by construction**, not by convention: invalid check digits, reserved phone ranges, reserved email domains, all enforced by a checker that runs before commit and *undoes the seed* when violated. It is an allow rule, not a block list — blocking one real email domain just lets the next one through.
- **Sensitive content is never written, not even briefly.** A reset token is hashed, and the body carrying it in clear text is never inserted at all, because writing and then deleting leaves the value in the database between the two operations, and in the write-ahead log after that.
- **Output is scanned by value, against what the process actually decrypted** — not against a list of field names somebody remembered to maintain. A list of names protects the fields someone thought of.
- **One test patches the network stack** (`net`, `http`, `https`, `fetch`) so that any outbound call throws, proving a code path made no call at all rather than asserting it politely.
- **An import-graph scan enforces that nothing which talks to the model can reach a credential.** The list of files that talk to the model is *derived from the imports themselves*, so a file that starts calling the model tomorrow is covered without anyone registering it. It runs in both directions, strips comments before scanning so it doesn't fail on the comment explaining the rule, and carries a positive control proving it can still catch a real violation.

Then the counter-proof: put the leak back, and watch the scan go red.

And the limits, stated plainly. A marker's absence proves a property on the path you tested; it is not anonymization. A type contract is not authorization. Classifiers miss things, and a free-text field will carry whatever someone typed into it. None of this is a compliance claim.

The honest framing is not "stop pasting things." People will paste things, because the alternative is being slower than the person next to them. The framing that works is the one we already use for every other untrusted boundary: assume data will enter, decide per destination what may leave, and make the decision a test rather than a habit.