Anthropic’s push for friction-free AI development has created a serious supply chain vulnerability. A convenience feature in its new Claude Code assistant leaked thousands of developer secrets onto public GitHub repositories. Security researchers found that a simple “don’t ask again” prompt stored plaintext passwords, AWS keys, and SSH logins in local configuration files, exposing the collision between autonomous AI agents and standard enterprise security controls.
Quick Take
- The incident: Claude Code’s “Yes, and don’t ask again” permission feature saved full, unredacted shell commands containing live credentials directly to a local
.claude/settings.local.jsonfile. - The exposure: Research by Apiiro found over 2,500 secrets—including database passwords, AWS access keys, and Supabase service-role keys—exposed across nearly 2,000 public GitHub repositories.
- The scanner blindspot: Standard enterprise secret-scanning tools reportedly missed hundreds of these files, leaving deep vulnerabilities in git histories and repository forks.
- The AI infra reality: The race to build fully autonomous, frictionless AI coding agents is fundamentally breaking traditional developer security protocols.
What happened
When developers use Anthropic’s Claude Code, the terminal assistant occasionally prompts for permission to execute shell commands. To reduce friction in the development workflow, users can select a “Yes, and don’t ask again” option. Security researchers at Apiiro revealed that clicking this option saves the exact literal command string in plaintext inside a .claude/settings.local.json file. If a developer embedded an API key, database password, or SSH login into that specific shell command, the secret was written directly into the local configuration.
Because this file is stored locally within project directories, developers unknowingly committed it to their public source control. Apiiro’s scans across more than 103,000 public GitHub repositories uncovered 1,122 active configuration files containing at least 1,379 distinct secrets. When researchers expanded the scope to include older file versions, agent logs, and related git artifacts, the exposure ballooned to over 2,500 leaked credentials tied to at least 63 different organizations.
Complicating the cleanup, simply deleting the .claude/settings.local.json file or adding it to a global .gitignore does not erase the threat. Credentials remain active in commit histories, cached views, and repository forks. Security experts stress that exposed developers must immediately rotate their database passwords, SSH keys, and cloud tokens before attempting to purge the files from their git tracking.
Why it matters now
This incident exposes a fundamental tension in the current AI infrastructure race: the battle between agentic autonomy and enterprise security. Companies like Anthropic, OpenAI, and GitHub are aggressively pushing coding assistants that operate with increasing independence. But eliminating friction-like repetitive permission prompts-often means overriding the very speed bumps that prevent catastrophic security breaches.
For the broader AI ecosystem, this leak is a wake-up call regarding the new attack surfaces created by LLM-powered development tools. The industry is no longer just securing code written by humans; it must now secure the configuration files, agent transcripts, and memory states generated by the AI assistants themselves. The fact that major secret-scanning tools missed hundreds of these exposed Claude Code files indicates that traditional DevSecOps infrastructure has not yet adapted to the bespoke artifacts generated by local AI agents.
As AI models move from simple code autocomplete to orchestrating cloud infrastructure and database migrations natively from the terminal, the blast radius of a compromised local settings file scales exponentially. Enterprise CTOs and DevSecOps teams are now forced to build fresh governance models for AI tooling, treating every AI-assistant configuration file as a high-risk vector that requires distinct scanner tuning and strict repository-level ignore rules.
Who is most affected
The immediate fallout impacts developers, startups, and open-source maintainers who actively beta-tested or deployed Claude Code in public GitHub environments. However, the downstream risk hits DevSecOps and cloud infrastructure teams who must now audit git histories for leaked tokens that automated scanners may have missed.
| Stakeholder | Impact | Why |
|---|---|---|
| Claude Code Users | High risk of hijacked accounts or infrastructure. | Plaintext API keys, AWS tokens, and database passwords were inadvertently committed to public repositories via unredacted shell commands. |
| Enterprise DevSecOps | Blindspots in secret detection and compliance. | Legacy secret-scanning tools failed to identify AI-generated .claude/ configuration files as sensitive targets, leaving active secrets exposed. |
| Anthropic & AI Vendors | Pressure to redesign permission logic. | The incident forces AI companies to rethink how local agents store state and manage context without caching sensitive user data in plaintext. |
About the analysis
Researched and written with AI assistance under the editorial responsibility of the i10X News team. The title image is an AI-generated illustration. Read our AI Use Policy. Spotted an error? Request a correction.
This is an independent, research-based i10x analysis intended for DevSecOps teams, CTOs, and AI infrastructure builders navigating the security implications of autonomous coding agents.
- “Don’t ask again” in Anthropic’s Claude Code leaks developer secrets
- Claude Code ‘Don’t Ask Again’ Bug Exposes 1,122 GitHub Credential Files | Aviatrix Threat Research
- Claude Code’s “Don’t Ask Again” Feature Caused 2,539 Secrets to Flow into Public GitHub Repositories
- Claude Code Files Exposed API Keys
i10x Perspective
The Claude Code leak is not just an oversight; it is a structural growing pain in the evolution from AI copilots to autonomous AI agents. As models gain the ability to execute complex terminal commands, the very mechanics meant to keep them seamlessly integrated are inadvertently creating highly concentrated, plain-text vulnerabilities. Until AI infrastructure can securely abstract credential management away from local prompt histories and agent memory, the push for “frictionless” AI development will remain a massive liability for enterprise deployment.
