Anthropic’s Claude Code AI assistant is leaking sensitive credentials into public GitHub repositories through insecure configuration files

The rapid integration of AI-powered coding assistants into software development workflows has ushered in a new era of productivity, but it has simultaneously introduced critical security vulnerabilities. A recent investigation by software security firm Apiiro has revealed that Anthropic’s "Claude Code" assistant, a tool designed to streamline development tasks by executing shell commands, has been inadvertently leaking passwords, API keys, and other sensitive tokens into public GitHub repositories. The issue stems from the tool’s "always-allow" functionality, which saves command history—including plain-text secrets—into a local JSON file that is frequently committed to version control systems by unsuspecting developers.

The Mechanism of the Leak

Claude Code operates by requesting user permission before executing shell commands. To improve user experience, the assistant offers a "Yes, and don’t ask again" option. When a user selects this, Claude Code generates an entry in a local configuration file, specifically .claude/settings.local.json. This file is intended to act as an allow-list, enabling the AI to execute matching commands in future sessions without further prompting.

The security failure occurs because the tool saves the command verbatim. If a developer includes an authentication credential—such as a database password, an AWS secret key, or an API token—directly within the command string, that sensitive information is stored in plain text within the JSON file. While the software is designed to attempt to exclude this file from git via global git configuration, this mechanism is inconsistent and fails to account for developers who may manually commit the file or fail to configure their local environments correctly. Consequently, when developers push their code to platforms like GitHub, these secrets are exposed publicly, often remaining in the repository’s commit history long after the file has been deleted or modified.

Chronology of the Vulnerability

The exposure of these credentials is not a new development, but rather the result of a long-standing oversight that has been reported by the community on multiple occasions.

• August 11, 2025: A formal bug report was submitted to the official Claude Code repository, specifically detailing how approved commands containing API keys and tokens were being stored in the settings.local.json file.
• Late 2025: Despite the potential severity of the issue, the report remained unaddressed by the development team.
• January 3, 2026: An automated triage bot, programmed to prune inactive issues, closed the original bug report due to a lack of activity over a 60-day window.
• February 2026: Security researchers at Apiiro conducted a comprehensive audit of public GitHub repositories, identifying over 1,100 files containing sensitive secrets leaked by the tool.
• March 2026: The broader security community began receiving reports of the incident, as researchers noted that multiple follow-up tickets regarding the same issue were similarly closed by automated systems without human intervention from Anthropic.

Scope of the Data Exposure

The scale of the exposure identified by Apiiro is substantial. Their automated scans of public GitHub repositories discovered over 104,000 instances of the .claude/settings.local.json file. Of those, approximately 1.1%—or 1,122 instances—contained at least one verified secret. In total, the researchers documented 1,379 unique credentials.

The nature of these secrets poses a high risk to organizational security. The findings include:

• Database Credentials: Over one-third of the identified secrets were passwords for direct database access, including administrative-level credentials.
• Cloud Infrastructure Keys: 23 AWS keys were discovered, which could allow unauthorized actors to spin up resources, exfiltrate data, or compromise cloud environments.
• Developer Tokens: 42 tokens related to GitHub, GitLab, and npm were identified, potentially allowing attackers to compromise CI/CD pipelines or supply chain repositories.
• System Access: The researchers flagged 43 SSH login credentials for public-facing servers.

The impact extends beyond current files. Because git maintains a history of all changes, deleted secrets remain accessible in past commits and forks of the affected repositories. Researchers found an additional 734 secrets within historical versions of these files, highlighting that even "cleaning" a repository by deleting the file is insufficient to fully remediate the risk.

Challenges in Detection and Remediation

One of the most alarming aspects of this leak is that standard security hygiene tools often fail to catch it. Most automated secret scanners, such as Gitleaks or TruffleHog, are configured to look for specific patterns or entropy signatures associated with known API keys. However, when a password is provided as part of a standard shell command—such as mysql -p[password]—the tools often fail to distinguish the credential from the command itself.

In the Apiiro study, researchers noted that of the 1,122 files identified as containing secrets, common scanners missed over 200 of them entirely. This suggests that the current reliance on automated secret scanning is insufficient to mitigate the risk posed by AI coding assistants that log shell activity in plain text.

Furthermore, the "always-allow" nature of the tool means that once a secret is stored, it becomes a permanent part of the project’s configuration state, susceptible to being bundled into Docker images, ZIP archives, or npm packages, thereby expanding the attack surface far beyond the public repository.

Implications for AI Governance and Security

The incident highlights a fundamental friction between the push for rapid AI adoption and the rigorous security standards required in software engineering. While tools like Claude Code are built to minimize friction for developers, they often do so at the expense of security guardrails. By prioritizing "set it and forget it" workflows, the tool inadvertently encouraged developers to bypass safe secret-management practices, such as the use of environment variables or secret vaults.

The failure to address the community’s bug reports for months indicates a potential gap in the oversight of AI developer tools. For large organizations, the incident serves as a stark reminder of the "shadow AI" problem, where developers integrate tools into their environment without the explicit approval or security review of their IT departments. The fact that 63 different organizations, including several major software vendors, had their proprietary secrets exposed suggests that the issue is not limited to hobbyist projects but affects enterprise-level production environments.

Recommended Mitigation Steps

Security experts emphasize that simply deleting the file is an inadequate response. Given that the secrets have likely been pushed to public repositories, they must be considered compromised. The recommended industry standard for remediation in this context includes:

1. Immediate Rotation: All passwords, API tokens, and SSH keys found in the .claude/settings.local.json file—or any other associated configuration file—must be immediately revoked and rotated.
2. Git History Scrubbing: Organizations must use tools like BFG Repo-Cleaner or git filter-repo to permanently purge sensitive information from the entire commit history of affected repositories.
3. Auditing Access Logs: Security teams should review logs for any unauthorized access to the systems associated with the leaked credentials.
4. Implementing Strict Configuration Policies: Development teams should enforce policies that prevent the storage of local configuration files in version control, utilizing .gitignore files more aggressively and training developers on the risks of AI assistant logging.
5. Adopting Secret Management Solutions: Rather than relying on local configuration files, developers should be encouraged to use dedicated secret management tools (e.g., HashiCorp Vault, AWS Secrets Manager) that ensure credentials are never written to disk in plain text.

As AI continues to become a primary interface for writing and managing code, the responsibility for securing these interactions lies with both the vendors and the users. For Anthropic, the incident underscores the urgent need to prioritize "secure-by-default" designs, ensuring that AI assistants do not prioritize convenience over the integrity of a developer’s security posture. For the development community, it serves as a critical lesson in the necessity of verifying the data-handling practices of any AI tool before granting it access to sensitive local environments.