Your AI coding agent just logged a database root password

An AI coding agent opens a .env file to answer a developer's question. Whatever it finds goes into the tool call, and if the session is logged for audit, the tool call goes into the log pipeline. In a worked example from Alibaba Cloud, one tool result carried a MySQL connection string with a root password aimed at a production IP, an Alibaba Cloud AccessKey, and a PEM private key block. Alibaba Cloud says the credentials shown in the example are synthetic. The gap between what a coding agent reads and what it leaves behind is the one Alibaba's in-session code review set out to close.

That is the uncomfortable arithmetic of logging AI systems: the record has to survive for troubleshooting, auditing, and governance, which is why it cannot be deleted on sight. Alibaba Cloud's Simple Log Service (SLS) offers three places to intercept sensitive content, and choosing between them is less about features than about where trust ends. See also why security teams see trust as the thing that makes AI scale.

Where plaintext is allowed to leave the host

Client-side processing is the strictest. LoongCollector runs SPL, the service's processing language, during collection on hosts and containers, so plaintext never reaches the transport pipeline. For desktop agent telemetry there is LoongSuite Pilot, which discovers activity from Claude Code, Cursor, Codex, Qoder and similar tools, normalizes it into audit events for sessions, tool calls, model calls, and token use, and masks it before the data goes anywhere: SLS, JSONL, HTTP, or the OpenTelemetry Protocol.

SDKs, tracking libraries, and third-party pipelines skip the collector. An ingest processor protects those writes between arrival and storage, with rules held centrally in SLS, so one policy change covers every direct writer instead of an upgrade round across languages and business lines.

Logs already in a LogStore are the third case. Data transformation derives the metadata worth keeping, encrypts or masks the rest, and writes the result to a second, protected LogStore. Alibaba Cloud describes the usual shape as two stores: a controlled source and a broader one for sharing and long-term analysis.

Masking, symmetric encryption, or a split key

Three SPL functions cover protection. mask swaps values for a placeholder in two modes: buildin matches built-in patterns for phone numbers, emails, national IDs, bank card numbers, IP addresses, AccessKey pairs, and license plates, while keyword matches field names such as password, token, authorization, and api_key. Partial replacement keeps a phone number's first three and last four digits, and masked logs stay searchable and aggregatable.

aes_encrypt suits content that must be recovered later and assumes one owner for the key and initialization vector. Internal RAG Q&A and customer documents fit here. The ceiling is stated plainly: once the key is shared, every holder can decrypt everything.

envelope_encrypt divides the work. A random data encryption key encrypts the payload, then an asymmetric public key encrypts that key. Collection holds only the public key; a security or audit team safeguards the private one. Only the data key takes the slower asymmetric path, so collection throughput barely moves.

The payload field-level masking cannot reach

Structured fields are the easy half. A gateway log with a client IP, a model name, and a token count can be split, masked, and still counted for call volume and access trends. Free text is harder. In one example, a Pilot-collected llm.response event carries a gen_ai.output.messages field holding the entire text of a model's answer, which may include internal system names, host details, configuration data, or keys. No single rule list enumerates that, one reason specialized security models keep beating general-purpose ones, per the model comparison.

The transformation shown instead derives what analysis needs, here the response length in characters, and envelope-encrypts the body, replacing the original field with ciphertext and a separately encrypted key. Sessions, models, and users stay traceable from metadata; reading the body requires the private key.

Data source	Stage	Method
Gateway and container logs that cannot leave the host	LoongCollector at collection	mask, or encrypt selected fields
SDKs and third-party writers going straight to SLS	Ingest processor	Masking or encryption before ingestion
Logs already stored but not yet protected	Data transformation	Mask or encrypt into a new LogStore
RAG Q&A content that needs controlled recovery	Collection or ingest	aes_encrypt
Whole blocks of sensitive output	Collection or transformation	envelope_encrypt

Who holds the key is an org chart question

The decision comes down to three questions. Can plaintext leave the collection source? If not, process it there. Do routine analysts need to read the content? If so, keep it readable and encrypt only what is sensitive as a whole. Who is allowed to decrypt? One team inside a single security domain can manage a key centrally, while split collection and audit duties point toward envelope encryption.

Two details matter as much as the architecture. Masking is off by default, with mask.mode accepting none, all, or custom, so coverage depends on someone enabling it. And Pilot's built-in rules recognize credential formats from several vendors, among them Alibaba Cloud's LTAI prefix, AWS's AKIA and ASIA, Tencent Cloud's AKID, OpenAI-compatible sk- keys, and GitHub tokens beginning with ghp_, gho_, or ghs_. A masking engine that knows the shape of three clouds' keys says something about how far agent telemetry now travels. Attackers already prize those keys, as Umbrij's theft of live OAuth tokens shows.

The pipeline holds up only if someone writes the configuration that turns it on. See also: how AI agents are rewriting the rules of cybersecurity.