How Claude Code's Convenience Feature Silently Leaked 1,379 Secrets Into Public GitHub Repositories
Executive Summary
Executive Summary In November 2026, software security firm Apiiro disclosed that Anthropic's Claude Code AI coding assistant was silently persisting plaintext credentials inside a project-level settings file, .claude/settings.local.json, whenever developers selected the 'Yes, and don't ask again' permission option. Across 103,617 public GitHub repositories, researchers identified 1,122 copies of the file containing at least 1,379 distinct secrets, including 379 database passwords, 43 SSH credentials, 42 VCS tokens, and 23 AWS access keys. Because Claude Code adds the file only to a user's global git excludes rather than the project's own .gitignore, the protection fails to travel with repositories, leaving committed secrets permanently accessible in git history and forks. At least one confirmed live credential was found prior to disclosure, and 63 organizations were identified among the affected file owners.
This incident highlights a systemic risk posed by AI-assisted development tooling: implicit trust in convenience features can silently erode credential hygiene at scale. As agentic AI tools become standard in software pipelines, the attack surface for credential harvesting expands dramatically, demanding that security teams extend secret-scanning policies, gitignore governance, and pre-commit controls explicitly to agent configuration and memory files.
Why This Matters Now
Why This Matters NowAgentic AI coding assistants are now embedded in mainstream developer workflows across thousands of organizations. This exposure demonstrates that a single default behavior in one widely adopted AI tool can passively leak credentials into public repositories at scale, with no attacker action required. Regulatory pressure around software supply chain security and AI governance is intensifying globally, making unaddressed AI tool misconfigurations an immediate compliance and liability risk.
Attack Path Analysis
Attack Path AnalysisDevelopers using Claude Code's 'don't ask again' feature inadvertently stored plaintext credentials inside .claude/settings.local.json files, which were then committed to public GitHub repositories — in many cases by Claude itself acting as a co-author. Once publicly indexed, adversaries could trivially harvest 1,379 live secrets including database passwords, SSH keys, AWS access keys, and OAuth tokens without any exploitation of a vulnerability, using only passive reconnaissance and automated credential scraping. The absence of egress controls, secrets scanning enforcement, and zero-trust network policies allowed harvested credentials to be leveraged for direct cloud resource access, lateral movement across services, and potential data exfiltration with no network-layer tripwire in place.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionAttackers or opportunistic scrapers discovered .claude/settings.local.json files in 103,617 public GitHub repositories. These files contained plaintext credentials — including AWS keys, database passwords, SSH credentials, and API tokens — embedded verbatim inside approved shell commands saved by Claude Code. No authentication bypass or exploit was required; credentials were publicly readable. The CNSF Cloud Native Security Fabric capability, which covers shadow AI risk and agentic AI control plane exposure, is directly relevant: inline enforcement and real-time inspection of AI agent output artifacts could have flagged credential-containing configuration files before they propagated to public repositories.
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesUnsecured Credentials: Credentials In Files
Data from Information Repositories: Code Repositories
Impair Defenses: Disable or Modify Tools
Valid Accounts
Data from Cloud Storage
Email Collection: Email Forwarding Rule
Command and Scripting Interpreter
Automated Collection
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Protection of Stored Credentials and Secrets
Control ID: Requirement 3.5.1 / 8.6.1
NYDFS 23 NYCRR 500 – Training on Cybersecurity Risk / Limitations on Data Retention
Control ID: Section 500.14 / 500.7
DORA (EU) 2022/2554 – ICT Security: Secrets Management and Anomaly Detection
Control ID: Article 9(4)(e) / Article 10
CISA Zero Trust Maturity Model 2.0 – Least Privilege Access and Secrets Hygiene
Control ID: Identity Pillar: Credential Management / Data Pillar: Data Inventory and Classification
NIS2 Directive (EU) 2022/2555 – Supply Chain Security and Vulnerability Handling for ICT Tools
Control ID: Article 21(2)(d) / Article 21(2)(e)
HIPAA Security Rule (45 CFR Part 164) – Encryption and Decryption of ePHI / Person or Entity Authentication
Control ID: §164.312(a)(2)(iv) / §164.312(d)
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Developer AI tool misconfiguration exposes plaintext credentials in 1,122 public GitHub repos, enabling lateral movement and exfiltration risks mapped to NIST.800-53.SC-7 and PCI.4.0 compliance frameworks.
Health Care / Life Sciences
Medical-records database owner passwords confirmed exposed via Claude Code settings files, violating HIPAA.164.312(e)(1) and creating direct patient data exfiltration risk requiring immediate credential rotation.
Information Technology/IT
AWS keys, SSH logins, and GitHub tokens leaked across 103,617 repositories, threatening cloud infrastructure integrity and triggering ZTMM.Network and NIST.CSF.PR.DS-2 compliance obligations for IT security teams.
Financial Services
Database passwords and cloud admin keys exposed in public forks trigger PCI.4.0.4.2.1 and egress security violations, with 217-day average exposure windows amplifying unauthorized access and exfiltration blast radius.
Sources
Sources- Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubhttps://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.htmlVerified
- Coding Agents Leaking Secrets on GitHub - Apiiro Researchhttps://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-againVerified
- Claude Code Permissions Documentationhttps://code.claude.com/docs/en/permissionsVerified
- Claude Code Settings Documentationhttps://code.claude.com/docs/en/settingsVerified
- GitHub Issue #5544 - Approved commands with API keys stored in settings.local.jsonhttps://github.com/anthropics/claude-code/issues/5544Verified
- Shai-Hulud Worm Compromises npm Packages in Supply Chain Attack (September 2025)https://thehackernews.com/2025/09/40-npm-packages-compromised-in-supply.htmlVerified
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is relevant here because harvested credentials — though obtained passively from public repositories — required open network paths and unrestricted cloud API reachability to be operationally useful. By enforcing identity-aware segmentation, controlled egress, and east-west flow policies, CNSF would likely have constrained the blast radius even after credentials were exposed, limiting how far adversaries could move and what data they could reach.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Inline inspection of AI agent output artifacts and real-time policy enforcement could have flagged credential-containing configuration files before they propagated outward, reducing the window during which live secrets were publicly accessible and actionable.
Control: Zero Trust Segmentation
Mitigation: Identity-based policy enforcement with least-privilege SmartGroups would likely constrain how far stolen credentials could be leveraged, reducing the privilege scope accessible to an adversary using valid but out-of-context credentials.
Control: East-West Traffic Security
Mitigation: East-west segmentation policies enforcing workload-to-workload isolation and inter-region flow controls would likely detect and constrain anomalous service-to-service authentication patterns, reducing the reachability of stolen credentials across internal cloud segments.
Control: Multicloud Visibility & Control
Mitigation: Centralized multicloud traffic observability and policy enforcement could surface anomalous API call patterns and out-of-baseline automation behaviors, reducing the window during which adversaries could establish persistence undetected across cloud control planes.
Control: Egress Security & Policy Enforcement
Mitigation: FQDN-based egress filtering and outbound traffic policy enforcement would likely constrain unauthorized data transfers to unrecognized external destinations, reducing the number of viable exfiltration paths available to adversaries using stolen cloud and database credentials.
Even with credentials already exposed, prior CNSF enforcement across earlier stages would likely have reduced the operational blast radius — limiting how many cloud resources, databases, and downstream repositories adversaries could have reached with stolen secrets before detection.
Impact at a Glance
Affected Business Functions
- Software Development and CI/CD Pipelines
- Cloud Infrastructure Access Management (AWS, GitHub, GitLab, npm registries)
- Database Administration and Data Access (PostgreSQL, MySQL, medical records systems)
- SSH and Remote Server Administration
Estimated downtime: N/A
Estimated loss: N/A
Across 1,994 public GitHub repositories, 2,539 secrets were exposed including 379 database passwords (including at least one owner-level password for a medical-records database), 43 SSH credentials for public servers, 42 OAuth and registry tokens for GitHub, GitLab, and npm, and 23 AWS cloud access keys including at least one admin-level key belonging to a database vendor. Secrets were confirmed live in at least one organization at time of disclosure. Additionally, 734 secrets persist in deleted file versions across git history in 509 repositories, and 211 forks of 74 repositories propagate the same secrets as their originals. Affected organizations include 63 entities, predominantly software companies of varying sizes. Data categories at risk include cloud infrastructure credentials, source code repository access tokens, database authentication credentials, remote server login credentials, and potentially regulated health information accessible via exposed medical-records database credentials.
Recommended Actions
Key Takeaways & Next Steps
- • Treat all AI agent configuration folders (.claude/, .cursor/, .gemini/) as potential secret stores equivalent to .env files — enforce organization-wide .gitignore templates and pre-commit secret scanning hooks that detect passwords embedded inside shell commands, not only known API key formats, to prevent credential commits before they reach any repository.
- • Deploy Egress Security & Policy Enforcement (FQDN filtering, outbound DLP) to block unauthorized data transfers initiated by compromised cloud credentials, ensuring that even valid keys harvested from public repositories cannot be used to exfiltrate data to attacker-controlled destinations without triggering policy violations.
- • Apply Zero Trust Segmentation with identity-based, least-privilege SmartGroup policies so that cloud credentials — even when valid — are only honored from approved workload identities and network contexts, preventing lateral movement from developer endpoints to production databases or cloud management APIs using stolen tokens.
- • Activate Multicloud Visibility & Control to establish behavioral baselines for cloud API usage and flag anomalous patterns such as credential use from new geographic locations, unexpected IAM role assumptions, or bulk database queries that deviate from normal developer workflows associated with the exposed key identities.
- • Integrate Cloud Native Security Fabric (CNSF) inline enforcement across CI/CD pipelines and cloud control planes to provide real-time inspection of agentic AI outputs — including configuration files written by coding assistants — ensuring secrets are detected and blocked at the point of artifact creation rather than discovered months later through passive public repository scanning.
