I put a fake AWS key in a file and asked Claude Code to read it twice in the same session: once with its Read tool, once with cat . An OWASP Guardian sat between the agent and its tools.

With cat , the model got this:

AWS_ACCESS_KEY_ID=[REDACTED]

Enter fullscreen mode

Exit fullscreen mode

With Read, it got this:

AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE

Enter fullscreen mode

Exit fullscreen mode

That's the example key from the AWS documentation, not a real one. Only the tool changed, and I got the same result in all four runs.

What I was testing

The Agent Control Standard (ACS) is a wire specification from the OWASP GenAI Security Project. A separate Guardian Agent sees what an AI agent is about to do, and can permit, deny or modify it before it happens.…