International
The Morning Dev

Only the news worth knowing

‹
 

Security · High impactFan score 64 · Tier A6 sources

AI Coding Agents Leak Thousands of Secrets to GitHub

Dark Reading · By Elizabeth Montalbano ·

AI Coding Agents Leak Thousands of Secrets to GitHub

The Brief · written from 6 sources

  • Claude Code's "Yes, and don't ask again" option saves approved shell commands to settings files, which can contain passwords, tokens and API keys.
  • Apiiro researchers found secrets, including database passwords and API keys, in settings files on public GitHub, with 1,122 public GitHub files cited in one source.
  • The leak stems from a partial oversight in how Claude Code's settings files are handled, not from an external hack or prompt injection.

Why it matters

Developers who approved commands containing credentials may have committed those secrets to public repositories, where they can be harvested by anyone.

Who’s affected

  • Developers using Claude Code
  • Teams with public GitHub repositories containing Claude Code settings files

What to do

  1. Check Claude Code settings files in your repositories for passwords, tokens and keys
  2. Rotate any credentials found in publicly committed settings files
  3. Remove exposed secrets from repository history, not only the latest commit

A command in Claude Code inadvertently saves files with credentials and other sensitive data to public Git repositories, creating security gaps for organizations.

Read the full story at darkreading.com ↗

Timeline

  1. The Hacker News

    Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub

  2. Hacker News: Front Page

    Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files

  3. DEV Community articles report that Claude Code's "Don't Ask Again" leaked developers' secrets to public GitHub

  4. DEV Community: ai

    Claude Code's "Don't Ask Again" Leaked Developers' Secrets to Public GitHub — Explained Honestly

  5. DEV Community: ai

    Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files

  6. Ars Technica reports Apiiro's finding of leaked secrets in Claude Code settings files on GitHub

  7. AI - Ars Technica

    Claude Code is accidentally exposing secrets all over GitHub

  8. darkreading

    AI Coding Agents Leak Thousands of Secrets to GitHub

Full coverage · 6 sources

How do you feel about this?

0 Comments

    AI Coding Agents Leak Thousands of Secrets to GitHub – The Morning Dev