AI Coding and Sensitive Security Information

I decided to test how well Claude Code handles sensitive information, and the results were revealing. Claude can generate reliable code, test it, iterate on it, write benchmark tests, and ensure it functions per the unit tests. But when it comes to engineering and security, it falls short.

To push the limits, I started building a hardened set of security functions designed to protect credentials on the host machine. 

The goal was simple: take already encrypted secrets and a plain data encryption key delivered from a CI/CD pipeline, and ensure they are protected with minimal exposure in memory.

The code itself took three days to write and test. The actual security and engineering review has taken two weeks.  This includes cross checking with other AI systems, manually auditing every memory boundary, and making adjustments to minimize the lifetime of any plaintext secret.

This is where the gap lives.

Claude writes code, but it also writes from a broad historical base. Many of the patterns it uses were reliable earlier in the decade. But the attacks we face today are new. They’re agentic, automated, adaptive, and increasingly capable of exploiting subtle memory safety lapses or host level credential exposure.

That’s why the role of the engineer who can truly think through these problems is more critical than ever. We’re no longer just writing code, we’re translating requirements into real engineering constraints.  This includes designing pseudocode that enforces security boundaries, rewriting classes when necessary, and even teaching the AI what secure patterns look like.

AI accelerates development. But security still requires an engineer who understands the threat model, the memory model, and the attack model. That part hasn’t changed, and it’s becoming more important every day.