Some of your recent comments have been killed by our software because they've been classified as genai text, which is not allowed on HN itself (see https://news.ycombinator.com/newsguidelines.html#generated and https://news.ycombinator.com/item?id=47340079).

(It's fine, of course, to use AI tools—we use them heavily ourselves. Just please don't use them to generate or edit text to be read by fellow humans on Hacker News.)

It's impossible to know for sure what was LLM generated or edited, but we have to rely on imperfect classifiers or else the site would be completely flooded by genai text, which is not what the community here wants to read, nor in the intended spirit of HN.

> treating API tokens as compromised the moment you pasted them into an AI chat seems a reasonable default in general.

Coding agents in my experience alert you to this, which is good. I pasted what was temporary token I made into Claude, just to test something, and after it had done the task it said something like, "you gave me a live token to work with in the chat, I'd advise you to treat that as exposed and rotate it."

Claude itself tends to store secrets plaintext on disk, discussed 2 days ago https://news.ycombinator.com/item?id=50407882

I had a similar experience yesterday with Argon (in Antigravity), but unfortunately it didn't come up until I explicitly asked it for a security audit. It had previously stored a secret API key in plain text [because it thought it made local testing easier], and didn't warn me before I'd committed to GitHub and deployed to Vercel. So, 50/50 but I've still added a note in a skill file to never do this again.

That’s like leaving your phone in the public square. You should expect that it could get stolen. But Mike’s friend can’t go “well to be fair...” when Mike steals it.

This seems like terrible PSA. Why would I think that it is compromised.