In Neovim, a pasted secret can reach the screen for one frame before the mask catches up, and a recording keeps that frame. I measured what cloak.nvim, shelter.nvim and camouflage.nvim draw while you type and paste, what they cost, and which files they can read.
Three self-propagating npm campaigns in twelve months: the TanStack compromise in May, ChainDrop through keyv in August, 400 plus packages backdoored from one stolen token. Auditing won't get you out of this. These are the controls that actually stop a worm at the door, with the config for each.
Every agent I audited this year had the same kind of problem. It authenticated as a service account with more access than any human on the team, on behalf of a user whose identity was lost the moment the request left the browser, so the logs couldn't say who a call was for. Fixing it is mostly an OAuth problem, and the pieces exist now.
One GitHub issue was enough to make a coding agent leak a private repo through the official MCP server. In January the Git MCP server fell to path traversal from a prompt alone. I don't think either was a model failure. Both were the mistake we made with SQL in 2004, sending data and instructions down the same wire.