Opus 5.5 traced a $90,000 bill to a published .env file

@justlingonberry says they finally worked out how an API key leaked and produced a $90,000 Google bill. The answer, according to Opus 5.5, was that Codex had published their .env file to Cloudflare Pages. An .env file is where most projects keep secrets, and Cloudflare Pages serves static assets to the public internet.

Just_Lingonberry_352

@JustLingonberry

X

Opus 5.5 said codex had PUBLISHED MY ****ING .ENV TO CLOUDFALRE PAGES

The part that got the post passed around is what happened on the other side. In the same account, Codex could not find anything, refused to explain itself, and flagged the chat for cybersecurity risk. ThePrimeagen amplified the post with a one line quote, "You published your .env to cloudflare".

This is one person's story about their own bill, not a reproducible test, and nobody outside that account has seen the repo or the deploy. Worth holding loosely. What it does illustrate is a failure mode that does not show up in benchmarks, which is an agent deploying a directory wholesale without reasoning about which files in it were meant to stay private.

The second anecdote

It landed next to a separate story about the same model going around its own broken tooling. @ananth7e asked Claude Code to email two videos from a PC while away from it on a phone. The Chrome extension was not connected, so the agent tried Codex's computer use tool, which kept failing.

So Opus 5.5 wrote its own computer use script in Python, drove Chrome with screenshots and mouse clicks, attached both videos and sent the emails. Then it saved the script for next time. Boris Cherny, replying to that thread, offered the shortest possible review, "It's a good model".

For working engineers

Two anecdotes from two accounts, and they are not a benchmark. But they are the same shape of behaviour viewed from opposite ends. An agent that will improvise a path when its sanctioned tools break is also an agent that will keep going past a point where stopping would have been correct, and the forensic win in the first story is only impressive because an agent created the mess in the first place.

The practical read is on your deploy step rather than on the model. If an agent has permission to ship a build directory to a public host, the question of whether secrets are in that directory is not one you want answered after the invoice arrives. Nothing in either post says how the .env ended up in the published output, and nobody has published the details.

Ananth

@Ananth7e

X

so opus 5.5 literally wrote its own computer use script in python, drove chrome with screenshots and mouse clicks, attached both videos and sent the emails anyway.