Claude Code’s “Don’t Ask Again” Feature Leaks Passwords and API Keys in Over 1,100 Public GitHub Repos
What Happened – Anthropic’s Claude Code AI‑assisted coding tool includes a “Yes, and don’t ask again” option that records the exact command a developer approves. When that command contains a password or API key, the tool writes the secret verbatim into a project‑settings file. Apiiro discovered 1,122 public GitHub repositories that contain such files, exposing dozens of passwords, API tokens, and other credentials to anyone browsing the code. The exposure was identified by a security researcher who flagged the repositories for secret‑leakage scanning; Anthropic has since removed the feature from new projects but the already‑published files remain publicly readable.
Why It Matters for Trust & Control Assurance – The incident highlights a gap in credential‑handling controls and the need for continuous monitoring of code repositories for secret leakage.
Who Is Affected – Software development teams using AI‑assisted coding assistants, SaaS providers that embed Claude Code, and any downstream customers whose secrets were stored in the exposed files.
Recommended Actions –
- Enforce a policy that forbids embedding secrets in code or AI‑assistant prompts.
- Deploy automated secret‑scanning tools on all repositories (including pre‑commit hooks).
- Rotate any credentials that appeared in the leaked files and audit access logs for misuse.
- Review AI‑tool configurations and disable “don’t ask again” persistence for commands that may contain sensitive data.
Technical Notes – The leak resulted from a misconfiguration of Claude Code’s project‑settings persistence mechanism. No CVE is associated, but the root cause is the uncontrolled storage of user‑supplied commands. The exposed data includes plaintext passwords, cloud‑service API keys, and internal tokens. Source: The Hacker News