Keep your AI logins and keys safe

Keep passwords, API keys, recovery codes, and card numbers out of AI chats. If one already went in, change it today, turn on two-step sign-in, and delete the chat. If a key leaked, revoke it at the provider and make a new one. Let agents sign in through a password manager instead of your clipboard. And export your chat history now, while your account is in good standing.

This week was a good reminder of why. A breach at an AI coding tool exposed people's saved API keys, 1Password shipped a way for agents to log in without seeing your password, and big U.S. banks started blocking AI agents that sign in with customers' credentials. Every vendor claim below links to the vendor's own page or a news report, all checked October 23, 2026.

Keep secrets out of the chat box

A chat with an AI assistant is not a private notepad. Depending on the product and your settings, what you type can be saved, reviewed by people, used to improve models, or shared by link. Here is what three of the big ones say in their own help pages.

• Gemini. Google's Gemini Apps Privacy Hub says human reviewers read some chats and asks you directly: "Please don't enter confidential information that you wouldn't want a reviewer to see." The same page says chats that reviewers have looked at are kept for up to three years, even if you delete your activity. In the section on screen automation it is blunter: "Don't enter login or payment information into Gemini chats."
• ChatGPT. OpenAI's data controls page says that on personal Free, Plus, and Pro workspaces, "data sharing is enabled by default." You can turn off Improve the model for everyone, but that does not delete anything you already typed. OpenAI's shared links page adds that anyone with a link from a personal account can view the shared conversation, and it says not to include "passwords, account numbers, or other sensitive personal information in shared content."
• Claude. Anthropic's privacy center explains the Help Improve our AI models switch under Settings > Privacy. Turning it off stops new chats from being used for future training. Chats already in training runs, or in models that are already trained, stay there.

Connected agents raise the stakes. An agent that can read your email or drive a browser can carry whatever you hand it into places you did not plan. So the rule is simple: if it unlocks something, it does not go in the chat. That covers passwords, API keys, one-time codes, recovery codes, and full card or account numbers.

Already pasted one? Change it today

Do not wait to find out whether anyone saw it. Work through these in order.

1. Change the password on the account it belongs to, and anywhere else you reused it. If it was a key or token, skip to the next section.
2. Turn on two-step sign-in on that account and on your AI accounts. For ChatGPT, OpenAI's MFA page puts it under Settings > Security and login, with an authenticator app, push approvals, a text code, or a passkey as options, depending on your account. The same page notes that turning on MFA does not sign out your other devices. Use Log out of all devices on that screen if you want everyone kicked out.
3. Delete the chat.
   • ChatGPT: open the chat's ••• menu and pick Delete. OpenAI's delete and archive page says the chat leaves your view right away and is scheduled for permanent deletion within 30 days, with exceptions for security or legal holds. Archiving does not delete it.
   • Claude: open the chat's ⋮ menu and pick Delete. Anthropic's help page says it is removed from your history immediately and from its back-end systems within 30 days.
   • Gemini: go to Settings & help > Activity, or myactivity.google.com/product/gemini, and delete the item. Google's activity help page says deleting a shared chat does not delete its public link, so remove that link too.
4. Kill any shared link. In ChatGPT it is Settings > Data controls > Shared links > Manage, per the shared links page. Copies someone already saved to their own account stay with them.

Deleting the chat is cleanup, not a fix. The fix is that the old password no longer works.

After a breach, revoke and rotate your API keys

An API key works like a password for paid AI services. Whoever holds a copy can run requests on your bill. That is what happened to some OpenCode users. TechCrunch reported on October 19 that attackers broke into an older OpenCode system, affecting 1.4% of users of OpenCode Console, where some people stored their AI API keys. Some users reported charges in the hundreds of dollars, and a few described totals above $1,000. Anthropic and Google blocked the keys they believed were exposed, and OpenAI said it was refunding API credits used in the attack. OpenCode told affected users to revoke and replace their keys directly with each provider. The OpenCode app and command-line tool were not affected, according to its co-founder.

That last instruction is the whole playbook. Deleting a key inside the tool that leaked it is not enough. Revoke it at the source.

Then finish the job.

• Swap the new key in everywhere the old one lived: scripts, apps, and any tool that stored it for you.
• Check your usage page for requests you did not make. OpenAI's key safety page says to review usage and contact support if you suspect misuse.
• Set a spend limit. The same OpenAI page recommends monthly limits with hard enforcement, and notes that spend alerts alone do not stop traffic.
• Give each tool its own key and an expiration date where you can. OpenAI recommends expiring keys and a regular rotation. GitHub recommends adding an expiration to personal access tokens and choosing the smallest permissions you need.
• Never commit a key to a code repository. OpenAI and xAI both say so. GitHub automatically revokes tokens pushed to a public repository or gist, per its revocation page, and xAI says it works with GitHub's secret scanning to disable leaked keys and email you.

Let agents sign in through a password manager

When an agent hits a login page, the tempting shortcut is to paste your password into the prompt. 1Password's launch post for 1Password for Agents, published October 22, names that exact move as a problem: it means "allowing the agent to have access to your credential, potentially beyond the task at hand."

Here is how 1Password says the new flow works, from its press release:

• When an agent reaches a sign-in form, it verifies itself to 1Password with a unique digital key.
• You see which credential it wants and why, and you approve or deny it on your own device.
• 1Password fills the login directly into the sign-in form instead of sending it to the agent.

1Password lists integrations with Meta's Muse, Anthropic's Claude Duet, OpenAI's ChatGPT Work and dots, Grok Bot, and Town's Townie. Its blog says some are rolling out over the coming days and others are coming soon. It is available at no extra cost for 1Password Individual and Family accounts on 1Password.com. Accounts on 1Password.eu and 1Password.ca are not supported yet, and the blog says safeguards and capabilities vary by integration.

Banks are why this matters. USA Today reported on October 23 that Citi, Wells Fargo, Bank of America, and JPMorgan Chase have moved to limit third-party AI agents. A Citi spokesperson told the paper, "We do not permit third-party AI agents or assistants to log into a customer's account or transact directly within our digital banking platforms." The same report says Wells Fargo's updated online access agreement, set to take effect November 24, treats transactions by agents you let in as authorized, "including those you did not want or intend." A Chase spokesperson told Axios that customers "should not give their usernames and passwords to anyone," as TechCrunch reported. Before you point any agent at a bank account, read your bank's terms.

Export your chat history while your account is in good standing

If years of work live in your chat history, keep your own copy. Both big chat apps make this a few clicks.

• ChatGPT. Settings > Data controls > Export data > Export, then Confirm export. OpenAI's export page says the file can take up to 7 days to arrive, the download link expires 24 hours after you get it, and self-service export is not available in Business, Enterprise, or ChatGPT for Healthcare workspaces. If you cannot sign in, OpenAI points you to its Privacy Portal instead.
• Claude. Settings > Privacy > Export data, on the web app or Claude Desktop. Anthropic's export page says you cannot start an export from the iOS or Android apps, the emailed link expires after 24 hours, and exported data cannot be imported into another personal Claude account.

Why now and not later? Anthropic's safeguards page says it may ban accounts for repeated Usage Policy violations, account creation from an unsupported location, or Terms of Service violations. Banned Free, Pro, and Max users can still log in to export or delete their data, but the page says what you can export "may be restricted depending upon the Usage Policy violation." An export you already have cannot be taken back.

Treat the export file like the secrets it may hold. OpenAI's export page warns that downloaded data can include sensitive account information.

The five-minute checklist

1. Search your chats for anything that looks like a password or key. Change it, then delete the chat.
2. Turn on two-step sign-in for your AI accounts and your email.
3. Open each AI provider's key page and delete keys you do not recognize or no longer use.
4. Set a spend limit on every paid API account.
5. Export your ChatGPT and Claude history and store it somewhere safe.