Threat
AI Coding Agents Leak Thousands of Secrets to GitHub
First reported darkreading.com
Page published · Page updated
Earliest dated coverage: 10 Nov 2026 · First observed: 10 Nov 2026 · Latest dated coverage: 10 Nov 2026
Coverage timeline
Single-source incident — one report is available.
Why it matters
Claude Code's inadvertent credential commits can expose production systems, making repository audits, secret scanning, and rotation of exposed credentials important defensive actions.
Apiiro researchers found 2,539 exposed credentials across nearly 2,000 public GitHub repositories and traced some leaks to Claude Code copying secrets into a hidden file committed alongside developers' code. Exposed secrets included cloud keys, production database passwords, API tokens, and SSH root logins.
Summary
Apiiro research, as reported by Dark Reading on November 10, 2026, identified 2,539 exposed credentials across nearly 2,000 public GitHub repositories associated with AI coding-agent artifacts. A specifically investigated Claude Code workflow turns a routine command approval into persistent credential storage: selecting 'Yes, and don't ask again' can save the exact proposed command, including secrets, in .claude/settings.local.json. If that file is subsequently committed and published, credentials become accessible alongside the project code.[0]
The Claude Code settings-file investigation covered 104,185 publicly accessible files. Researchers found real secrets in 1,122 files, with 1,379 distinct secrets comprising 636 provider-specific keys and 743 passwords or tokens associated with public hosts. Reported examples included production credentials and privileged access material. These figures describe exposure, not confirmed downstream account compromise, and should not be conflated with the broader 2,539-credential total.[0]
The central safeguard gap is portability: Claude Code reportedly protects the file through the developer's global Git ignore list, not the project's own .gitignore. That machine-specific rule does not accompany the repository when cloned elsewhere. Apiiro contacted Anthropic before publication, and Anthropic subsequently discussed investigating mitigations; the supplied reporting names no released fix or fixed version. Immediate source-grounded responses are credential rotation, removal of secret-bearing permission rules, and scanning of agent folders and repository history.[0]
Disclosure timeline
| Date | Event |
|---|---|
| 2026-11-10 | Dark Reading published its account of Apiiro's credential-exposure research, including the Claude Code persistence mechanism, measured public-file exposure, and Anthropic's reported mitigation discussion. The article does not give exact dates for Apiiro's initial contact, original publication, or Anthropic's comments.[0] |
How it works
Credential material enters the workflow through otherwise legitimate development tasks. The report describes asking Claude Code to check a database or call an API, after which the tool proposes a command carrying a secret from a configuration file. The sensitive value is therefore present in the command being approved, rather than remaining confined to its original configuration location.[0]
The persistence trigger is the approval choice 'Yes, and don't ask again.' According to the research summarized in the article, this stores the exact command, secret included, in .claude/settings.local.json inside the project directory. An execution-approval decision can consequently create another credential-bearing artifact that the developer may not realize exists.[0]
Public disclosure requires the credential-bearing artifact to reach a public repository. The reported workflow does not, by itself, establish direct transmission of every approved secret to GitHub. Instead, the file can be included with other project content when Git protections do not prevent it from being committed and published.[0]
Claude Code reportedly attempts to prevent accidental inclusion by adding the settings file to the developer's global Git ignore list when creating it inside a Git repository. The weakness is that the exclusion is machine-specific: it is not written into the repository's own .gitignore and therefore does not travel with a cloned project. The file's local-settings role is not equivalent to a project-wide guarantee that it will remain private.[0]
The observed repository history also connects agent-assisted commits to affected files. In 539 of 1,105 repositories containing real secrets, a commit co-authored by Claude Code modified the settings file. This supports involvement of agent-assisted development in handling the exposed artifacts, but the stated measurement does not establish that each such commit introduced the secret or that a malicious actor used it.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Anthropic Claude Code | The investigated scope is the command-approval workflow that persists secret-bearing commands in .claude/settings.local.json after 'Yes, and don't ask again' is selected. The supplied report does not identify affected release numbers or a version range. | No released fix or fixed version is identified in the supplied reporting. Anthropic's head of Claude Code reportedly said the company was investigating approaches such as auto-mode checks and basic secrets scanning, with prototyping to assess tradeoffs before shipping changes.[0] |
Key takeaways
- A reusable command approval can also be a credential-storage operation. In the investigated Claude Code workflow, the security consequence is not limited to executing the approved command: its sensitive arguments can persist in a project-local settings file.[0]
- Machine-local Git exclusions are not portable project safeguards. The reported distinction between a global ignore rule and a repository-owned .gitignore explains how a nominally local artifact can remain exposed to accidental publication elsewhere.[0]
- Keep the measured populations separate: 2,539 credentials across nearly 2,000 repositories is the broader reported finding, while 1,379 distinct secrets in 1,122 files is the Claude Code settings-file subset.[0]
- This evidence supports a credential-exposure research finding, not attribution of an attack. The supplied article provides neither observed attacker use nor a released-fix version, and all substantive findings here rely on one secondary report summarizing Apiiro's research.[0]
Defensive actions
- Inspect every field in .claude/settings.local.json and remove permission rules containing credentials.: The approval workflow can preserve the entire command, including a secret, in this file. Apiiro specifically recommends opening all fields and deleting secret-bearing rules; reviewing only the original configuration file would miss the additional stored copy.[0]
- Rotate every credential the affected settings file has ever held, including credentials in files that were never committed.: This is Apiiro's stated remediation recommendation. The report identifies credentials in the persisted rules themselves, so remediation should not be limited to deleting the current file or checking whether it appears in a public repository.[0]
- Include AI-agent folders on developer laptops and in repositories in secret-scanning coverage, and scan repository history.: The observed exposures were in agent-generated configuration artifacts rather than only conventional application configuration. The report explicitly recommends treating agent folders as secret-bearing and including history, extending the review beyond the current source tree.[0]
- Add AI-agent folders to pre-commit secret checks rather than relying solely on Claude Code's global Git ignore entry.: The report recommends pre-commit coverage and explains that the existing global ignore rule is specific to one developer's machine. It does not accompany the repository to another machine, leaving a protection gap for the same project artifact.[0]