Agent Hush: Open-source tool prevents AI coding agents from leaking sensitive data
Agent Hush is an open-source tool that silently catches sensitive data before it leaves your machine. It was created by a developer whose AI coding agent pushed sensitive data including API keys, server IPs, and personal information to a public GitHub repository while they were working on an infosec project.
What Agent Hush addresses
The developer discovered this leak days after it happened and then examined other open-source repositories. They found that many developers are unknowingly shipping private information including:
- Real names in memory files
- Database credentials in configs
- SSH keys in dotfiles
Most developers have no idea this information is being exposed.
Tool details
Agent Hush is available on GitHub at https://github.com/elliotllliu/agent-hush. The tool specifically targets the scenario where AI coding agents might inadvertently include sensitive information in code commits or pushes to public repositories.
The developer's experience highlights a specific risk: while building a security project, their own AI agent leaked the very types of sensitive information the project was meant to protect. This tool was built as a direct response to that incident.
📖 Read the full source: r/openclaw
👀 See Also
OpenClaw cluster management: keep recovery path outside the cluster
A safer topology for OpenClaw-managed clusters: run Gateway and task state outside, use read-only access, and drive changes via PRs + CI + human-approved merge into Argo CD.
5 Malicious OpenClaw Skills That Passed ClawScan + VirusTotal: Unit 42 Analysis
Unit 42 found 5 malicious OpenClaw skills that bypassed ClawScan and VirusTotal. Techniques included runtime referral swapping, SOL pooling for pump-and-dump, and 22MB README padding to hide an AMOS dropper.
Stacked Defense Layers Drop Prompt Injection to 0 in Claude Code
Anthropic's Boris Cherny says layered defenses—training, intent classifiers, and input probes—reduce prompt injection to 0% on unseen attacks. The classifier is now free.
Claude Cage: Docker Sandbox for Claude Code Security
A developer created a Docker container called Claude Cage that isolates Claude Code to a single workspace folder, preventing access to SSH keys, AWS credentials, and personal files. The setup includes security rules and takes about 2 minutes with Docker installed.