So it didn't warn user that secrets are still visible in repo history and have to rotated, it only made that revert?

How did you catch it — scanner, review, or just noticed manually? I treat agent-generated diffs as untrusted by default now.

LLMs are not intelligent machines, they are lying engines that predict the next most likely thing to do or say. If publishing your credit card details, home address and blood type meshes with the last thing it ingested, it'll do it.

"… though to be fair, it did sincerely apologize and promised never to do it again."