Indeed. But if it's a model running on your own hardware it isn't as risky. And the Anthropic models are actually pretty good at kind of writing code that will look at contents of a file without fully looking at the content, so it's insecure but not quite as bad as an open("secrets.txt").read()

Local model or not, all LLMs are susceptible to prompt injection and making mistakes (like those cases where you see the agent randomly deleted someone's home dir.) That's what Goldman are likely worried about. Not Anthropic going rogue or something.

Concealing API keys is a relatively minor protection in the wider picture of the risks.

What does that mean? That it only reads part of it into context or RAM?

What does using a local model have to do with it? I’m not worried about the secrets going to Bob, I’m worried about them going to Eve.