2025: The Year AI Security Became Essential
The warnings were there in 2023 and 2024. Samsung engineers pasted source code into ChatGPT. Apple banned AI tools enterprise-wide. Security researchers showed how IDE context windows silently include credentials from adjacent files.
Most enterprise security teams treated these as edge cases — lapses in developer judgment, separate from any structural vulnerability.
2025 changed that framing entirely. What we saw across the industry was systematic, predictable code exposure driven by the design of AI coding tools themselves, far more than a wave of mistakes by careless engineers.
Here are the five incident patterns that defined AI security in 2025, and precisely how Pretense answers each one.
Incident 1: The Context Window Credential Sweep
The pattern. A developer uses Cursor or Claude Code to refactor a service. The IDE automatically includes several adjacent files in the context window — standard behavior for LLM-aware editors. One of those files contains a hardcoded API key from local development, left in place because it was supposed to be gitignored.
The key is transmitted to the LLM provider. If the provider stores prompt history (and in 2025, most did by default), the key now lives in a third-party system — potentially accessible under subpoena, data breach, or insider threat.
Why it kept happening in 2025. Cyberhaven's research found that 11% of data developers paste into AI tools is sensitive. For IDEs that automatically build context from the filesystem, the percentage is higher still because developers rarely see what is being transmitted.
How Pretense handles it. Pretense's secrets scanner uses 47 regex patterns covering every major credential format: AWS access keys, Stripe secrets, Anthropic/OpenAI API keys, GitHub PATs, database connection strings, PEM private keys. Every API call is scanned on the developer's machine before forwarding. Anything matching a secret pattern is swapped for a deterministic stand-in token at the proxy layer, so the request goes through and the real credential stays local.
[pretense] Intercepted POST /v1/messages
[pretense] SECRET DETECTED: aws_access_key (confidence: 99.8%)
[pretense] MUTATED — credential replaced with stand-in token
[pretense] Request forwarded with stand-in; real key kept on this machine
The developer keeps working. The provider receives only the stand-in, and the answer keeps that stand-in by design, so a prompt-injected model has only a placeholder to exfiltrate. The audit log records the event with timestamp, developer identity, and pattern match.
Incident 2: The Proprietary Algorithm Inference Attack
The pattern. A financial services company's ML team uses Claude Code to optimize their pricing model. The code includes actual variable names from their risk-scoring algorithm — a genuine competitive advantage. Claude gets plenty of signal from the names alone. From variable names like computeRiskBand, liquidityAdjFactor, historicalDefaultWeight — an informed adversary with prompt log access can reconstruct core logic.
How Pretense handles it. Mutation is the core innovation. Pretense replaces proprietary identifiers with stand-ins before the prompt leaves the machine.
Before (what the developer wrote):
computeRiskBand(historicalDefaultWeight, liquidityAdjFactor)
After mutation (what Claude actually receives):
_fn8c3d(_v2a9f, _v4b1e)
The function still exists. The call graph is intact. Claude can still refactor and optimize. And _fn8c3d reveals only a placeholder, so the purpose of the function stays private. When Claude responds, Pretense swaps the identifiers back byte-exact. The developer sees the real names; the provider sees only stand-ins.
Incident 3: The Cursor Code Storage Revelation
The pattern. In early 2025, users of popular AI coding editors discovered that conversation histories — including code snippets — were being retained on provider servers. This was technically in the terms of service, but the operational reality had stayed hidden from the security teams approving these tools.
The audit problem. When security teams tried to assess exposure — "what code from our codebase is stored in the AI provider's systems?" — they came up empty. Zero logs. Zero mutation maps. Zero record of what identifiers had been transmitted. The exposure was real but unmeasurable, which is often worse than a quantified breach from a compliance standpoint.
How Pretense handles it. Three layers of protection:
- -Mutation — real identifiers replaced with synthetics. Even if the provider stores the conversation, they store
_fn8c3din place ofcomputeRiskBand. - -Audit log — every transmission is recorded with metadata: timestamp, model, mutation count, secrets mutated.
- -Mutation map — the mapping between real and synthetic identifiers is stored locally. If you need to know what was sent in the past 90 days, the map answers that question with complete precision.
Incident 4: The Enterprise Architecture Exposure at Scale
The pattern. At Fortune 500 scale: dozens of teams, hundreds of services, thousands of developers, each making hundreds of AI API calls per day. The aggregate creates a comprehensive map of the entire architecture — transmitted daily to external providers while the inventory of what has been shared stays empty.
How Pretense handles it. In Pro and Enterprise, mutation maps are shared across teams. Every identifier from every service is mutated with the same deterministic algorithm: the same real name always produces the same synthetic name across all machines. An adversary who could read AI provider logs would see a consistent synthetic namespace, fully detached from the real architecture and practically impossible to map back to it.
Enterprise deployments run the proxy on-premises. The AI provider receives only mutations.
Incident 5: The Claude Code MCP Server Attack Surface
The pattern. Claude Code's MCP (Model Context Protocol) capabilities, widely adopted in 2025, allow AI agents to read files and interact with development environments. Security researchers documented that loosely scoped MCP configurations could allow the AI model to read files beyond intended context — including credential files, environment configurations, and CI/CD secrets.
A developer might have ~/.aws/credentials, .env, and id_rsa all accessible on their machine. With broad MCP permissions, these enter the model context via file-read operations — because the AI agent accessed them while trying to be helpful, with zero pasting by the developer.
How Pretense handles it. Pretense integrates directly with Claude Code via hook configuration:
{
"hooks": {
"PreToolUse": [
{
"matcher": ".*",
"hooks": [{ "type": "command", "command": "pretense scan --hook" }]
}
]
}
}
The hook scans the full prompt context — including content that MCP servers have read into the context window — for secrets and proprietary identifiers before transmission. This is the difference between scanning what the developer typed and scanning what the AI agent assembled.
The Common Thread
Five different incident patterns. One structural cause: AI coding tools were designed to be maximally helpful, which means maximally including context. Security tools designed for a previous era of explicit user actions were built for a different world than systems that silently and automatically aggregate context from the developer's environment.
The security response has to match the attack surface:
- -Scan what actually gets transmitted, the full payload the tool assembles, beyond what the developer thinks they are sending
- -Mutation over redaction — so LLM output quality is preserved while identifiers are protected
- -Local audit logs — because answering an audit question starts with data you logged
- -Proxy architecture — because enforcing controls starts with intercepting the traffic
Every incident pattern above has a direct Pretense control. Developers keep working exactly the way they work today.
What 2026 Looks Like for Teams Still Waiting on Controls
AI coding tool adoption continues to accelerate. Claude Code, Cursor, and GitHub Copilot are growing at rates that put them in the hands of every developer at most engineering organizations within 12-18 months.
The organizations that will be writing incident post-mortems in 2026 are the ones that treated AI tool security as a developer education problem in 2025.
The organizations that will be writing compliance attestations and passing AI-specific SOC 2 controls are the ones that deployed technical controls in 2025, ahead of any incident.
The 30-second deploy is a real number. Pretense Pro is a single proxy configuration. The audit log starts immediately.
