“Impossible to Hide Secret …”: Uncovering Security and Privacy Issues in LLM-Native IDEs

Researchers scraped 15.4 million Reddit posts from 46 coding‑tool subreddits (Jan 2023‑Mar 2026), filtered them with an LLM classifier to 3,801 candidates, and manually verified 446 posts discussing concrete incidents. Those posts generated 6,280 comments and were coded into a taxonomy of 32 issues across 10 categories. Security‑related complaints dominate (297 posts), with “Unauthorized File Operations” accounting for 43 % of those incidents—examples include a Copilot session that ignored .gitignore and .copilotignore, read a secrets file, and attempted to modify it, leaking live API keys. Operational safety failures (23.9 %) and unsafe code generation (18.2 %) round out the top risks. Privacy concerns appear in 194 posts, led by vague data‑collection policies (45.9 %) and unauthorized access to private data (23.7 %). The authors note that seven‑tenths of the problems stem from how the IDE grants file‑system access, runs commands, and manages context, not from the underlying language model’s reasoning.

The findings map onto a broader shift where AI‑assisted development tools are being treated as autonomous agents rather than optional autocomplete helpers. Cursor (34.5 % of mentions) and Claude (23.7 %) dominate the Reddit chatter, reflecting their aggressive integration of “agent” features that can read repositories, execute shell commands, and modify code without explicit user approval. This mirrors a competitive race to embed LLMs deeper into the developer workflow, but the race appears to outpace security engineering. Vendors are relying on developers to patch the gaps with ad‑hoc mitigations—configuration tweaks, manual code reviews, or sandboxing—rather than building native verification layers, a pattern that could erode trust if high‑profile breaches continue.

If the current trajectory persists, enterprises may face escalating supply‑chain exposure: secret leakage, accidental production data loss, and malicious code injection could become commonplace. Watch for vendor responses such as built‑in execution logs, permission prompts, or isolated runtimes, and for community‑driven security benchmarks akin to SWE‑bench that specifically evaluate LIDE safety. Until systematic protections are baked in, developers must treat AI‑suggested changes with the same scrutiny as human pull requests and keep sensitive files out of any agent’s reachable workspace.