Agent chaosAs reported·19 Oct 2026
Developer blames Codex for a leaked .env and a $90,000 Google bill
As reported One person’s public account. We couldn’t independently confirm it, and we’ll update this if the facts change.
A developer says Claude Opus 5.5 traced their $90,000 Google bill to Codex publishing their .env file on Cloudflare Pages.
This is one developer's account on X, not independently confirmed. On 15 October the developer posted that they'd finally worked out how their key leaked and ran up a $90,000 Google bill: Claude Opus 5.5 told them Codex had published their .env file, where projects keep secret keys, to Cloudflare Pages, which serves files to the public internet. Days earlier they'd posted that someone stole their keys after they passed out during a livestream coding session.
They say Codex couldn't find anything and flagged the chat as a cybersecurity risk, and that .env was in their .gitignore. Nobody outside has seen the repo or the deploy. The post still went viral, with over a million views.
Never let an agent deploy a whole folder blind. Keep secrets out of build output and scan before you publish.