AI CURATED HOT STORY · 11/8/2026
Security firm Apiiro has discovered a critical flaw in Anthropic's Claude Code: the "Yes, and don't ask again" option persists full commands containing sensitive credentials—including database passwords, cloud admin keys, API tokens, and SSH root login details—in plaintext to the local settings file .claude/settings.local.json. Although Anthropic's documentation states this file is added to the global .gitignore by default, the protection has gaps, resulting in 2,539 real secrets leaked across 1,994 public GitHub repositories and affecting 63 organizations.
Cross-validation by Apiiro shows the leaked credentials span multiple high-privilege categories, enabling attackers to directly access databases, cloud resources, or servers. The fact that many files still reached public repositories indicates the safeguard is not effectively enforced. Boris Cherny, head of Claude Code, acknowledged the issue and said the team is working on mitigations, including auto-mode interception and basic secret scanning, but no timeline has been provided.
The incident highlights a deep tension between convenience and security in AI coding assistants. As tools like Claude Code rapidly gain adoption among developers, the interaction design of auto-approving commands may inadvertently become a new channel for credential leaks. The industry needs stricter default security measures, such as mandatory secret scanning, sensitive data redaction, and more reliable .gitignore enforcement, or similar risks will continue to grow with the widespread deployment of AI coding tools.
The line compares only sources observed throughout; gap hours are interpolated to keep the trend continuous.