A convenience feature designed to stop Claude Code from pestering developers with repeated permission prompts is instead publishing their credentials to the world. Security researchers at Apiiro say they have discovered thousands of secrets — including database passwords, API tokens and root logins — embedded in Claude Code configuration files that developers have committed to public GitHub repositories.
The findings, reported by Ars Technica and quickly picked up by The Hacker News, Cybernews and iTWire, center on .claude/settings.local.json, the file where Anthropic's command-line coding agent stores the preferences a developer sets while working. The story has become an early case study in the risks of agentic AI tools that sit close to live systems, credentials and production infrastructure.
How a convenience feature became a leak
The mechanism is mundane. When Claude Code proposes a shell command — a database migration, an API call, a deployment script — the user is asked to approve it. One of the options is "Yes, and don't ask again." Choosing it writes a rule into the local settings file so the agent can repeat similar commands without interruption.
The problem is in how that rule is recorded. Sometimes the approval is stored as a pattern, but frequently the command itself is written verbatim into the settings file — and command lines are exactly where developers paste tokens, connection strings, passwords and other secrets.
On a single laptop, that is innocuous enough. The trouble begins when the file is committed to a repository and pushed to GitHub, where it becomes searchable by anyone, including automated scrapers that trawl the platform for exposed credentials.
Anthropic's Claude Code documentation notes that the settings file is added to the developer's global .gitignore list, which usually prevents it from being shared publicly."Usually" is doing a lot of work in that sentence. Global gitignore rules can be overridden, bypassed by developers configuring a fresh machine, or defeated by tooling that force-adds files. Apiiro's researchers found the results in the wild: repositories where the local settings file had been pushed alongside the rest of the project.
1,122 copies, and a much larger pile of secrets
The outlets emphasized different numbers, reflecting different framings of the same discovery. The Hacker News put the sharpest figure in its headline: Claude Code's "Don't Ask Again" File Exposes Passwords and Keys in 1,122 Public Copies on GitHub. Ars Technica focused on the underlying data, reporting that researchers found thousands of secrets inside those files, spanning database credentials, API tokens and root logins.
Cybernews widened the lens considerably, headlining its coverage AI agents are leaking their owners' secrets on GitHub: thousands of files exposed — casting the incident not as a quirk of one vendor's configuration file but as a structural problem for the entire class of autonomous coding agents. iTWire, meanwhile, leaned into the enterprise angle, framing the discovery as company secrets rather than individual developer credentials, a distinction that matters for security teams assessing whether their own engineering organizations are affected.
A dispute over severity
The most notable divergence among the sources is how serious they consider the flaw. Ars Technica argued the issue is not especially severe if the file stays on the developer's local machine — assuming, of course, that the machine itself has not been compromised. In that reading, the leak is a hygiene failure by users rather than a vulnerability in Anthropic's product.
Others are less forgiving. The exposure is ultimately caused by a design decision: writing raw command text, secrets included, into a file that lives inside a project directory that developers routinely publish. A more defensive design would store approval rules as abstracted patterns, redact anything resembling a credential, or refuse to persist commands containing high-entropy strings. None of that appears to happen by default.
The disclosure also raises questions about disclosure itself. Anthropic's documentation addresses the gitignore behavior, but it does not appear to warn prominently that approved commands — secrets and all — may be written verbatim into a file adjacent to source code.
Secrets sprawl is an old problem with a new vector
Leaked credentials are among the most persistent failures in software. Committed .env files, hardcoded AWS keys and accidentally published npm tokens have caused breaches for more than a decade, prompting GitHub to build secret scanning and push protection directly into its platform. Those defenses catch many known credential formats — but they work best when secrets appear in expected places.
AI coding agents amplify the problem in two ways. First, they execute commands, which means secrets pass through command lines far more often than they did when developers typed them manually. Second, they generate configuration artifacts rapidly and in unfamiliar formats, giving both developers and automated scanners less context for spotting trouble. The same pattern has begun appearing across the agent ecosystem as tools compete on autonomy and convenience.
What developers and security teams should do
- Audit every repository for committed
.claude/settings.local.jsonfiles and any other agent-generated configuration directories. - Rotate any credential that has ever appeared in an approved command. Deleting a file from a repository does not remove it from Git history or from forks and caches.
- Verify that global and repository-level
.gitignorerules cover agent settings directories, and add pre-commit hooks to enforce them. - Prefer scoped, short-lived tokens over long-lived root or administrative credentials in any tool that runs shell commands.
- Treat agent approval prompts as a security boundary — the "don't ask again" option should be reserved for commands that cannot contain secrets.
The bigger picture
The Claude Code episode is a small technical flaw with an outsized symbolic weight. As AI agents take on more autonomy — writing code, running commands, touching production systems — the friction of asking permission becomes a product liability, and vendors will be tempted to smooth it away. Every shortcut taken in the name of usability creates a new place where secrets can accumulate silently.
For Anthropic, the fix may be as simple as changing what gets written to disk when a user clicks "don't ask again." For the broader industry, the lesson is harder: autonomous tooling needs the same rigor around credential handling that security teams already demand of build pipelines and CI systems. The alternative is a growing archive of machine-generated configuration files, scattered across public repositories, quietly holding the keys to the systems they were meant to automate.
