A critical security vulnerability within Anthropic’s AI coding assistant, Claude Code, has exposed thousands of sensitive credentials, including API keys, database passwords, and SSH tokens, to the public internet. Security researchers at Apiiro recently identified that the tool’s default behavior—specifically when users opt for the "Yes, and don’t ask again" permission setting—results in the verbatim storage of shell commands in a local JSON configuration file. When these commands contain sensitive information, that data is inadvertently saved in plaintext, creating a significant risk for organizations and individual developers alike.
The Mechanics of the Leak
The core of the issue resides in the .claude/settings.local.json file. According to Anthropic’s own technical documentation, Claude Code is designed to request explicit user authorization before executing shell commands. To streamline the user experience, the assistant offers an "always allow" feature triggered by the prompt, "Yes, and don’t ask again."
Once a user selects this option, the tool creates an "allow rule" within the settings.local.json file, effectively whitelisting that specific command or pattern for future use. However, the implementation of this feature lacks sufficient sanitization. If a developer runs a command that includes a hardcoded secret—such as a database password following a mysql -p flag or an API key passed as an environment variable—Claude Code records the entire command string, including the sensitive credential, directly into the configuration file.
While Anthropic intended for this file to remain local, the mechanism for preventing its exposure is flawed. The tool attempts to add the file to the user’s global git exclusion list upon its first creation. However, this relies on the developer’s local machine configuration and does not automatically propagate to the repository itself. Consequently, if a user commits the .claude directory to version control, the secret-laden file is uploaded to platforms like GitHub, where it becomes visible to anyone with access to the repository.
Chronology of the Vulnerability
The discovery by Apiiro highlights a persistent issue that has been raised by the developer community for months. A timeline of the events reveals a concerning lack of responsiveness:
- August 11, 2025: The first public bug report was filed on the official Claude Code GitHub repository, explicitly warning that approved commands containing API keys and tokens were being stored in plaintext within
settings.local.json. - Late 2025: Throughout the latter half of the year, multiple reports emerged from users noting similar behavior. Despite the severity, these reports saw minimal engagement from the development team.
- January 3, 2026: An automated moderation bot closed the original August bug report, citing "no activity" for 60 days. This pattern repeated for several other related tickets, with the most recent reports being closed as recently as this week.
- Current Date: Security researchers at Apiiro published their findings, confirming that the issue remains unaddressed and that thousands of repositories are actively leaking credentials.
Scope of the Exposure
The scale of the data leak is substantial. Apiiro’s analysis of public GitHub repositories identified 104,185 copies of the settings.local.json file across 103,617 repositories. Of these, approximately 1.1%—or 1,122 instances—contained at least one verified secret. In total, researchers uncovered 1,379 unique credentials that had been exposed to the public.
The types of secrets found are diverse and carry significant security implications:
- Database Credentials: More than one-third of the findings involved direct access to databases, including 379 administrative-level passwords.
- Cloud and Infrastructure Keys: The researchers identified 23 AWS access keys, which could allow attackers to hijack cloud infrastructure.
- Authentication Tokens: The data included 42 tokens for major platforms such as GitHub, GitLab, and npm.
- SSH Logins: 43 SSH credentials for public-facing servers were exposed, providing a direct vector for remote code execution.
Among the impacted entities are at least 63 organizations, ranging from small startups to large software firms. In some cases, the leaked credentials included high-privilege administrative keys for cloud services and even passwords for medical-records databases, highlighting the catastrophic potential for data breaches.
Limitations of Current Security Scanning
A disturbing aspect of this leak is the failure of industry-standard security tools to detect it. Many automated secret scanners, such as Gitleaks and TruffleHog, rely on pattern matching to identify known formats for API keys or tokens.
Because Claude Code often stores these secrets as part of standard, human-readable shell commands, they do not always conform to recognizable "secret" formats. For instance, a password typed into a standard terminal command like pgpass or mysql appears to scanners as an innocuous string of text. Apiiro reported that their own testing showed these tools failed to flag 215 of the 1,122 files confirmed to contain secrets, illustrating a significant blind spot in current DevSecOps practices.
Broader Implications for AI Security
The incident raises fundamental questions about the integration of AI agents into software development workflows. Unlike traditional IDE plugins, which generally operate within a constrained environment, AI coding agents are increasingly given broad permissions to execute shell commands, manage files, and interact with infrastructure.
When these tools are designed with "convenience-first" features, the resulting security debt can be massive. The fact that the file is not automatically added to the project’s .gitignore file—a standard practice for sensitive configuration files—represents a failure to follow established industry norms. Furthermore, the reliance on an automated bot to close security reports without human triage suggests that the project’s governance model is currently ill-equipped to handle the risks associated with AI-driven automation.
Mitigation and Remediation Steps
For developers and security teams currently using Claude Code, the advice from security researchers is urgent and multifaceted:
- Immediate Credential Rotation: Because the secrets have been pushed to version control, simply deleting the file is insufficient. Any credential, API key, or password that has ever been present in the
.claude/settings.local.jsonfile must be considered compromised and should be immediately rotated. - Git History Cleanup: Removing the file from the current directory does not delete it from the git history. Developers must use tools like BFG Repo-Cleaner or
git filter-repoto excise the sensitive files from all branches and commit history. - Audit Forks and Dependencies: The research shows that 211 forks of 74 repositories contain the same leaked secrets. Developers should audit all downstream dependencies and forks to ensure they are not inadvertently distributing hardcoded secrets.
- Global Git Excludes: While not a perfect fix, ensuring that the
.claudedirectory is included in global~/.gitignoreorexcludefiles can provide a layer of defense against accidental commits. - Enhanced Monitoring: Security teams should implement custom detection rules that specifically look for the presence of
.claude/settings.local.jsonin their repositories, as generic scanners have proven ineffective.
Conclusion
The leakage of credentials via Claude Code serves as a cautionary tale for the rapid adoption of AI coding assistants. As these tools gain the ability to interact with production environments, the distinction between a helpful coding assistant and a security liability becomes increasingly thin. Anthropic has yet to issue a public statement or a patch to address the underlying architectural flaw, leaving the burden of remediation entirely on the developers who trusted the tool to manage their project settings. Until such a patch is released, users must treat the "don’t ask again" functionality with extreme caution, and organizations should consider disabling the use of such AI agents until their security posture can be verified.
