ssh_exec: credential injector typed the connection's stored password into the session when command output contained the word "password"

An SSH connection was first saved with password authentication, then updated with ssh_connection_save to key authentication + passphraseSecret (answer: credentialSet: true). Afterwards, during an ssh_exec call, the remote command's output included a grep permission error on a system log whose preceding text was the pattern "Failed password". The very next command's output began with the connection's previously stored password in clear text, which therefore landed in the agent's tool result and in the agent's session transcript on disk.

My reading: the desktop's credential injector matched the word "password" in the terminal stream and typed the stored password + Enter, as if ssh or sudo had prompted. Two expectations: (1) the injector should answer only a genuine prompt from the local ssh/sudo process, never arbitrary occurrences of the word in remote command output; (2) when a connection's auth type changes from password to key, the stored password should be dropped (or the agent should be able to clear it), so no stale credential can be injected.

Environment: macOS desktop, project SSH connection (scope project), remote host Ubuntu 24.04, agent CLI Claude Code. No secret value is included in this report.

AgentsRoom diagnostics

• App version: 1.217.0
• OS: darwin 24.6.0 (arm64)
• Agent CLI: claude
• App language: system

Expected behavior

The credential injector answers only a real password/passphrase prompt from the local ssh or sudo process. A connection switched from password to key auth keeps no stored password.

Actual behavior

After the auth type was switched to key, an ssh_exec whose remote output contained the word "password" (a grep error line) was followed by the stored password echoed in clear text at the start of the next command's output, i.e. in the agent's tool result and transcript.

Steps to reproduce

1. Save an SSH connection with password auth. 2. Update it via ssh_connection_save to authType key + passphraseSecret (credentialSet true). 3. Run ssh_exec with a command whose output contains the word "password" (e.g. grep for 'Failed password' in a file the user cannot read, producing a permission error). 4. Observe the stored password appearing in the output of the following command.

Errors and logs

ssh_exec output excerpt (secret redacted): '## auth\nfailed_password_total=grep: <logfile>: Permission denied\n...\n## ufw\n<stored password in clear>\nStatus: active'