ReadingResearchRadarInvestment frameworkAI Company Primary Sources
Sign in / Sign up
← Back to reading
NewsMaterial3 min readDisconfirmAI Editorial

Claude Code Wraps Commands in eval, Database Passwords Remain Visible in ps Output

V2EX user mysoko reviewed 253 Claude Code session records and found that 16 contained plaintext passwords. Reproduction tests showed that Claude Code wraps commands in a composite structure of source snapshots and eval; the parent shell process retains the full command line throughout execution, even though curl itself has already masked the password in child processes.

2026-11-03 18:24 GMT+8

V2EX user mysoko searched through Claude Code session records on their own machine: among 253 jsonl files, 16 instances featured patterns such as mysql -p passwords or curl -u user:pass. They then ran a test using Claude Code version 2.1.317 with a fake password in a curl command, while capturing ps output from a separate process, discovering that the exposure surface was broader than initially assumed.

Two processes appeared in the ps output. The lower line represents curl itself, where the password characters have been replaced with spaces—confirming that curl does perform this masking action. The upper line shows the zsh instance launched by Claude Code, which retains the entire command line including the password for as long as curl is running.

This discrepancy stems from differences in execution methods. If you manually type bash -c 'curl ...' to run a single command, bash will directly exec into curl, hiding this intermediate layer. However, Claude Code wraps commands within a composite structure of source snapshot && ... && eval 'your command'; because the shell must remain active until execution completes, the complete command line persists in the process table.

Beyond ps, commands are also written verbatim into jsonl session records located under ~/.claude/projects/. This requires extra attention on servers: under default Linux mount parameters, proc(5) states that 'everybody may access all /proc/pid directories,' meaning other users on the same machine can view your command lines. Environment variables differ in this regard, as reading /proc/pid/environ requires passing ptrace permission checks. Users sharing development machines or jump hosts should note this distinction.

Sign in / Sign up
ReadingResearchRadarInvestment frameworkAI Company Primary Sources

mysoko provided a self-check regular expression that counts matches without printing content. Their results showed 16 affected sessions and 8 lines in shell history. They explicitly noted that the regex is coarse and prone to both misses and false positives, but any non-zero count warrants investigation. A workaround requiring no additional tools involves configuring ~/.my.cnf and ~/.pgpass separately with chmod 600 permissions, and adding a directive in CLAUDE.md or AGENTS.md stating that secrets should not appear in command arguments but rather use the client's own configuration files. Passwords that have already entered sessions must be changed immediately; deleting jsonl files is ineffective as the data has already been sent to the model.

They currently employ a custom tool called rootkey to create an isolation layer: instructing AI to execute rootkey run "order_db" --env-var PGPASSWORD -- psql ..., ensuring values only enter the environment variables of that specific subprocess, leaving only entry names visible in ps and session records. However, they acknowledge this is not a silver bullet: MySQL's official recommendation remains using configuration files with 600 permissions; malicious programs running under the same user can still read environment variables and files.

Sources

  • v2ex.comV2EX↗
Continue researching →