Anthropic's Claude Code Leaks Thousands of Developer Credentials on GitHub

Security researchers at Apiiro have uncovered a significant vulnerability in Anthropic's Claude Code AI assistant, leading to the exposure of thousands of sensitive developer credentials in public GitHub repositories. The core of the problem lies in Claude Code's functionality, specifically how it handles approved shell commands. When a developer uses the "Yes, and don't ask again" option for a command containing a password or API token, Claude Code saves this command, including the embedded secret, into a local settings file (e.g., `.claude/settings.local.json`). While these files are intended to remain local and are typically added to a user's global Git ignore list, this protection often fails when projects are cloned or when folders are later initialized as Git repositories, resulting in the sensitive files being committed and uploaded publicly. This incident is critical for practitioners because it directly impacts the security posture of their development environments and, by extension, their applications and infrastructure. Exposed credentials, such as database passwords, cloud service keys, and SSH credentials, can grant attackers unauthorized access to critical systems. Apiiro's research identified over 104,000 copies of these settings files in public GitHub repositories, with 1,122 containing real, valid secrets. The implications are severe, ranging from data breaches and operational disruptions to financial losses and reputational damage. The fact that even widely used security scanners like Gitleaks and TruffleHog missed a significant number of these exposed secrets underscores the inadequacy of current detection methods for this specific vector. This vulnerability fits into a broader, well-established trend in cloud and DevOps security: the persistent challenge of secrets management and the emerging risks associated with AI-driven development. The proliferation of non-human identities and AI agents in development workflows introduces new attack surfaces. As AI tools become more integrated into the software development lifecycle, the potential for AI agents to inadvertently expose sensitive information or be exploited to access privileged resources increases. The Cloud Security Alliance (CSA) has noted that 82% of surveyed organizations have unknown AI agents operating in their IT environments, and 65% reported an AI-agent-related incident in the past year. This highlights a growing blind spot where AI's utility clashes with traditional security paradigms. In practice, developers and security teams must take immediate and proactive steps. First, it is imperative to audit all GitHub repositories for the presence of `.claude/settings.local.json` and `.claude/settings.json` files. Any detected secrets must be immediately revoked and rotated. Second, organizations should re-evaluate their secrets management strategies, moving away from embedding credentials directly in code or configuration files, especially when using AI coding assistants. Implementing robust secrets management solutions that integrate with CI/CD pipelines and provide automated scanning for exposed credentials is crucial. Finally, practitioners should closely monitor updates from Anthropic regarding this vulnerability and consider alternative methods for managing approved commands within AI coding tools that do not involve local file storage of secrets. This incident serves as a stark reminder that while AI enhances productivity, it also introduces novel security challenges that demand vigilant and adaptive security practices.