Anthropic's Claude Code 'Don't Ask Again' Feature Leaks Secrets to Public GitHub Repositories

A recent discovery by security firm Apiiro has revealed a critical vulnerability stemming from Anthropic's Claude Code AI assistant: its "Yes, and don't ask again" feature inadvertently leaks sensitive credentials to public GitHub repositories. When developers opt to use this convenience feature, Claude Code saves the approved command, which can include database passwords, SSH logins, API keys, and other tokens, directly into a local configuration file (`.claude/settings.local.json`). If this file is then committed to a public GitHub repository, these secrets become openly accessible. Apiiro's analysis found 1,379 unique secrets across 1,122 files in 103,617 public repositories, with GitGuardian identifying an even larger scope of 31,088 secrets across 23,276 repositories. This incident underscores a growing challenge in cloud security, particularly with the increasing adoption of AI-powered development tools. The significance for practitioners is immense: the very tools designed to boost productivity can introduce severe security risks if not managed with extreme caution. The exposure of credentials like database passwords, AWS keys, and GitHub tokens can lead to unauthorized access, data breaches, and compromise of entire cloud environments. This affects any organization using Claude Code, especially those with less stringent code review and secret management practices. The ease with which these secrets are exposed, often through a simple developer oversight, makes this a high-impact vulnerability. This event fits into a broader trend of supply chain attacks and credential exposure in cloud and DevOps environments. The industry has seen a rise in attacks exploiting compromised credentials and misconfigurations, often accelerated by AI. The proliferation of AI agents and their integration into development workflows introduces new attack surfaces. As Mark McClain, CEO of SailPoint, notes in his new book, "Identity Under Attack," the corporate footprint now extends far beyond human employees to include non-human and agentic identities, each requiring careful access governance. The Docker Sandboxes vulnerability (CVE-2026-103916), which allowed AI coding agents to bypass file access restrictions and potentially expose cloud credentials, is another example of this emerging threat landscape. The core issue is often a lack of continuous visibility and real-time security oversight for these new forms of identity and automation. In practice, practitioners must immediately audit their GitHub repositories for instances of `.claude/settings.local.json` and any other configuration files that might contain hardcoded credentials. All exposed credentials must be rotated immediately. Furthermore, organizations should implement stringent secret management practices, ensuring that sensitive information is never committed to version control, even in private repositories. This includes leveraging dedicated secret management tools and integrating them into CI/CD pipelines. Developers should be educated on the risks associated with convenience features in AI tools and the importance of secure coding practices. Finally, a robust process for continuous monitoring of public repositories for leaked credentials is essential, as simply deleting the file does not remove it from Git history. The focus should shift from reactive cleanup to proactive prevention and a comprehensive understanding of the security posture of all AI tools used in the development lifecycle.