The most convenient button in Anthropic's Claude Code — "Yes, and don't ask again" — has quietly turned into a credential-leaking machine, according to new research from application security firm Apiiro. When developers approve a command that contains a secret, Claude Code saves that exact command, secret included, to a local settings file that frequently ends up committed to public GitHub repositories. Apiiro's scan found 2,539 real secrets sitting in 1,994 public repositories: database passwords, cloud API keys, tokens, and SSH root logins, spread across 63 organizations, most of them software companies. One affected company confirmed to researchers that an exposed key had been live. It is the second Claude Code privacy incident this month, following the tool's disclosure of user emails to websites via User-Agent headers — and this one touches production infrastructure, not just contact details. We follow AI coding agent security closely in our AI tools coverage.
How a Permission Rule Becomes a Leak
The mechanism is a side effect of Claude Code's permission system, which asks for approval before running shell commands — often multiple times per session. Ask the agent to debug a database connection or call an internal API, and the command it proposes carries whatever credentials that task requires, because it cannot work without them.
Choose "Yes, and don't ask again," and Claude Code runs the command and writes a permission rule to `.claude/settings.local.json` inside the project folder. The rule is not an abstraction: it is the full command string itself, password typed in plain text and all.
The file is designed to stay on the developer's machine, and Claude Code does try to protect it — by adding it to the developer's global git ignore list. That covers the common case, but not the edge cases: a folder that becomes a repository later, a clone on another machine where the global ignore doesn't exist, or a file someone committed before the ignore entry was added. Crucially, the rule never lands in the repository's own `.gitignore`, so no protection travels with the project.
Compounding the problem, Claude Code often commits the file itself. In 539 of the 1,105 repositories where Apiiro traced a real secret, a commit co-authored by Claude had changed the settings file — commits that name models ranging from Sonnet 4.5 to Opus 5.5. Apiiro notes the behavior is Claude Code's own, not the model's: the firm reproduced it with both Opus 5.5 and Fable 5.1.
The Scale of the Exposure
Apiiro counted 104,185 public copies of `.claude/settings.local.json` on GitHub. Of those, 1,122 contain at least one real secret. The researchers found 1,160 more secrets hiding in repository git history, in the shared `settings.json` files teams commit deliberately, and in saved agent chat transcripts checked into repos.
The examples Apiiro documents read like a worst-practices checklist. A database vendor exposed its own admin-level cloud API key — with manage access and no expiry — alongside its cluster host. A B2B startup leaked a production Azure Postgres password. A software agency exposed a Square production access token. An IT services firm building a medical-records application leaked the owner password of that database. Open-source projects fared no better: one with more than 1,000 stars published an OpenAI-format API key, another an npm token.
The security context makes the finding worse. Credential-stealing malware already sweeps developer machines in bulk — Apiiro points to the Shai-Hulud npm worm, which ran the TruffleHog scanner over victims' files. That same scanner would flag 643 of the 1,122 leaked files Apiiro found. More worrying is the residue: one in five of the leaked files is flagged by neither TruffleHog nor gitleaks, usually because the secret is a password typed inside a command rather than a key in a recognizable token format. Secret scanners, in other words, are structurally blind to this leak class.
What Affected Teams Should Do
Apiiro's remediation guidance starts with scoping the blast radius. Search your GitHub organization for `.claude/settings.local.json` and `.claude/settings.json` — every hit is a file anyone can read right now. Check each repository's git history for the file even if it has been deleted, because every fork and clone preserves whatever history contains. Then audit the local copies on every developer machine: each entry in the allow list is a command someone approved, with whatever was typed into it.
The firm's ordering matters: rotate first, clean up second. Deleting a file from a repository does nothing about credentials that were already public, and git history keeps exposed secrets alive indefinitely.
A Pattern, Not a One-Off
For Anthropic, the finding lands a week after Claude Code was caught leaking user email addresses to every website it visited through User-Agent headers — a bug fixed by shipping a privacy modification, which critics called a band-aid. The two incidents share a root cause: an agent that handles powerful context — credentials, contact details, internal hostnames — and makes default decisions about where that context travels.
The lesson generalizes beyond Claude Code. As coding agents become standard equipment, the files they write to organize themselves are becoming a new, unscanned corner of the software supply chain. Apiiro's numbers suggest that corner is already leaking at a scale most organizations haven't begun to measure.
Stay Ahead of AI
AI tools are shipping faster than their safety reviews can keep up. Follow every development in our AI news coverage.
Read more AI news →
