Comment by nijave

Yeah, I've had Claude read a dev key before by accident and it even stopped, said it read a key, and told me to rotate it immediately.

Assuredly it's not fool proof but it does have safeguards in place.

Ideally you also opt out of training although that doesn't keep it out of the vendor's logs/telemetry.

Short lived credentials, injected identity, and hardware backed tokens are the real solution.