Anthropic's Claude Code Exposes Credentials via 'Don't Ask Again' Feature, Highlighting AI Supply Chain Risks

The cybersecurity firm Apiiro has identified a significant security flaw in Anthropic's AI development tool, Claude Code, leading to the exposure of 2,539 login credentials across nearly 2,000 public GitHub repositories. The core issue lies within Claude Code's "Don't Ask Again" feature, designed to streamline workflows by remembering user approvals for tasks. However, if passwords are included in the commands for these approved tasks, they are stored in a separate record file. When developers then upload their code to GitHub, and if this record file is inadvertently marked for sharing, these sensitive credentials become publicly accessible. The investigation by Apiiro extended beyond currently public files to include past revision histories and AI conversation records, revealing data from 63 organizations. This incident is highly significant for practitioners as it introduces a novel pathway for information leakage directly tied to the use of AI development tools. As AI agents become more integrated into development pipelines, the potential for them to inadvertently expose sensitive data increases dramatically. The "Don't Ask Again" feature, while seemingly innocuous and productivity-enhancing, demonstrates how a seemingly minor design choice can have critical security implications. The fact that traditional security checks often fail to detect such exposures further exacerbates the problem, placing the onus on developers and security teams to adopt new paradigms for safeguarding credentials in AI-driven environments. This event fits into a broader, well-established trend in cloud security concerning software supply chain vulnerabilities and the expanding attack surface presented by AI. The Cloud Security Alliance's 2026 report highlights AI-enhanced attacks and AI system compromise as new top concerns, reflecting the rapid adoption of AI and the emergence of agentic systems. The industry has been grappling with securing open-source dependencies and developer tools for years, and the integration of AI agents adds another complex layer. Previous incidents, such as those involving OpenAI's agents breaking into third-party systems or the deprecation of Ingress NGINX due to unaddressed vulnerabilities, underscore the continuous need for vigilance in securing every component of the development and deployment ecosystem. The shift towards AI-first operations is creating new cloud security challenges, primarily driven by the gap between adoption and security needs. In practice, this means practitioners must immediately re-evaluate their use of AI development tools, particularly those with features that store command histories or task approvals. It is crucial to implement stringent policies that prevent the inclusion of sensitive information, like passwords, in any commands that might be logged or stored by AI agents. Furthermore, security teams should expand their code scanning and vulnerability assessment processes to specifically look for credentials within AI conversation records and associated development files, including past revisions. Developers should be educated on the risks of public repository sharing and the importance of carefully reviewing all files, especially those generated by AI tools, before committing them. Organizations should also consider adopting credential management solutions that integrate with AI development workflows, ensuring that AI agents access resources via secure, ephemeral tokens rather than static credentials. The trade-off between developer convenience and robust security must always err on the side of security, especially as AI agents gain more autonomy and access to critical systems.