Agent exposes API keys in terminal output without warning user #36647

Description

When running Get-ChildItem Env: (or similar commands that enumerate environment variables), the agent displayed API keys (\OPENAI_API_KEY, etc.) in plaintext in the terminal output without redacting them. The agent also failed to immediately warn the user that their keys were compromised — the user had to point it out.

Plugins

None

OpenCode version

deepseek-v4-flash (opencode-go/deepseek-v4-flash)

Steps to reproduce

1. Ask the agent to check environment variables (e.g., \Get-ChildItem Env:)
2. Agent runs the command and displays output containing credential values
3. Agent does not warn the user about exposed credentials

Operating System

Windows 11

Terminal

PowerShell 5.1