Anthropic's Claude Code leak: 2,539 secrets on GitHub

Security researchers have uncovered a significant credential exposure issue affecting Claude Code, Anthropic’s AI-powered coding assistant. The problem involves Claude Code approval settings that contributed to the exposure of 2,539 credentials and other secrets across 1,994 public GitHub repositories. The issue centers on commands approved with “Yes, and don’t ask again,” which can preserve embedded passwords or tokens in local settings files.

The discovery highlights a security risk inherent in how developers interact with AI coding tools. When users approve shell commands containing sensitive information and select the option to skip future approval prompts, those complete commands, including any embedded credentials, can be saved to configuration files that may later be committed to public repositories.

Scale of the Exposure

Apiiro identified 1,122 public copies of Claude Code’s settings file containing at least one secret, including database passwords, service keys, and account tokens. The security firm’s investigation revealed the extent of the problem extends beyond individual repositories, with 2,539 distinct exposed secrets found across repositories, Git history, and related coding-agent records.

The technical mechanism behind the leak involves the storage location for approved commands. Claude Code may save complete approved shell commands, including credentials, in `.claude/settings.local.json`. This file, when inadvertently committed to version control systems like Git and pushed to public repositories, exposes any secrets contained within those saved commands.

Perhaps most concerning is the detection gap revealed by the research. 215 of the identified secrets evaded both TruffleHog and GitHub Secret Scanning, two widely used tools for detecting exposed credentials in code repositories. This suggests that conventional secret-scanning solutions may not be sufficient to catch credentials stored in AI coding assistant configuration files.

Types of Exposed Credentials

The leaked credentials span a range of sensitive authentication materials that could provide unauthorized access to various systems and services. Database passwords represent one category of exposed secrets, potentially granting access to backend data stores. Service keys and API tokens, which authenticate applications to third-party services, also appeared in the exposed settings files. Account credentials for various platforms rounded out the types of secrets discovered in the public repositories.

Each of these credential types poses distinct security risks. Database passwords could allow unauthorized data access or manipulation. Service keys might enable attackers to impersonate legitimate applications or rack up costs on cloud platforms. Account tokens could grant access to user data or enable actions on behalf of compromised accounts.

Developer Concerns and Tool Adoption

The security disclosure arrives amid broader questions about the rapid evolution of AI coding tools. A developer said they had stopped using Claude Code as their primary coding harness and moved to the open-source Pi alternative. The developer criticized the tool’s rapid release pace and frequent changes to prompts and tool descriptions.

The tension between innovation speed and stability reflects a common challenge in the AI tools space. While frequent updates can deliver new capabilities and security fixes, they can also introduce breaking changes or, as this incident demonstrates, create new security considerations that developers must understand and manage.

Enforcement Versus Guidance

Anthropic has provided guidance distinguishing between different types of security controls in Claude Code. Anthropic’s Claude Code guidance reportedly distinguishes between prompt-based instructions, such as those in `CLAUDE.md`, and enforcement mechanisms such as hooks, deny rules, and managed settings. The latter are designed to apply consistently, while model instructions remain requests the agent may interpret.

This distinction matters for security-conscious developers. While instructions in configuration files like `CLAUDE.md` can guide the AI’s behavior, they represent suggestions rather than hard constraints. For scenarios requiring guaranteed enforcement, such as preventing the storage of credentials in settings files, technical controls like deny rules offer more reliable protection.

Recent Platform Updates

Anthropic continues to develop Claude Code alongside other platform improvements. Updates to Claude Code 2.1.319 include background handling for MCP task calls, a `denyInsteadOfPrompting` option, and changes to `/loop`. The `denyInsteadOfPrompting` option, in particular, may offer developers a way to prevent certain actions outright rather than relying on approval workflows that could inadvertently save sensitive data.

Separately, Anthropic introduced a message-threads feature that keeps sessions in server memory between requests, reducing median time to first token by roughly 35% for very large contexts. The feature is described as a public beta with a five-minute idle expiration. While this update addresses performance rather than security, it demonstrates the company’s ongoing platform development.

Implications for AI Coding Tools

The credential exposure issue underscores the need for developers to understand how AI coding assistants handle and store sensitive information. The convenience of approval-skipping features must be weighed against the risk that approved commands may be persisted in ways that could later result in exposure.

Developers using Claude Code or similar tools should audit their configuration files before committing them to version control, particularly settings files that may contain approved command histories. Tools that automatically exclude certain file patterns from Git commits can provide an additional layer of protection, though they require careful configuration to be effective.

The research also highlights the importance of scanning for secrets in non-standard locations. As AI coding tools become more prevalent, security scanning solutions will need to expand their coverage to include configuration files specific to these platforms.

Key Facts

2,539 credentials and secrets were exposed across 1,994 public GitHub repositories due to Claude Code approval settings
1,122 public copies of Claude Code’s settings file contained at least one secret
215 exposed secrets evaded detection by both TruffleHog and GitHub Secret Scanning
The issue involves commands approved with “Yes, and don’t ask again” being saved with embedded credentials in `.claude/settings.local.json`
Claude Code version 2.1.319 introduced a `denyInsteadOfPrompting` option for more restrictive controls

Sources

Written by

Mike Gingerich

Author

Author: Mike Gingerich, President of web firm Digital Hill, Co-Founder of TabSite .
Digital and Social Media Marketer, Speaker, and Business Consultant. Part geek, part marketer, total digital junkie! Seeking to add value, make the complex simple, and leave a positive impact.

Follow me on twitter: @mike_gingerich.