AI agent accidentally re-leaked a secret while documenting an earlier leak

An AI coding agent at a small studio, SynuraCore, exposed an API key fragment in a memory note, which was later published to git through a generated status page. Two months later, while compiling records into a book, the agent again exposed secret-related material in two committed files, despite a rule written in its shared lesson log. The team realized prose rules fail because risky cases often don't look like the rule itself. They added an automated check at commit time that scans for secret values and private terms, reporting only file and line without printing matches. Before enabling it, the team tested the check against 3,426 past commits and found 17 real hits.