Security researchers at Apiiro have uncovered a widespread problem in which Anthropic's Claude Code agent is inadvertently publishing sensitive credentials to public GitHub repositories, according to reporting from Ars Technica. The issue is not a classic software vulnerability but a design gap in how the tool stores user approvals for automated shell commands, combined with the ordinary habits of developers who push code to shared repositories.

How the leak happens

When Claude Code wants to run a shell command, it asks the user for permission. One available choice lets the user approve the command and stop being prompted for similar actions in the future. That decision is recorded as a rule in a local settings file inside the project's .claude directory. In some cases the rule is generalized into a pattern, but frequently the exact command is written to the file verbatim. If that command contained a database connection string, an API token, or a root password passed inline, the secret is now sitting in plain text in a configuration file.

On a developer's own machine this is a limited concern, barring a compromise of the machine itself. Anthropic's documentation states that this file is automatically added to the developer's global git ignore list, which ordinarily keeps it out of version control. The weakness is that this protection lives in the user's personal configuration rather than in the repository itself. If the project is cloned onto another computer, or if an existing folder is later turned into a git repository, the ignore rule may not apply and the file can be committed and pushed. Apiiro also reports that Claude Code itself often commits changes to the settings file without the user explicitly asking it to.

Scale of exposure

The researchers found over 100,000 instances of the local settings file sitting in public GitHub repositories. Most of those were harmless, but about 1,100 files, tied to 63 different organizations, held real secrets. These included public API tokens, database passwords, private keys and root logins. Apiiro published a breakdown of the secret categories it observed. Cleanup is also difficult: even after a file is deleted from a repository, the credentials can survive in forks of the project unless the owner takes additional steps, and the standard remedy is to rotate every exposed credential.

A known problem left unresolved

The finding is gaining attention now, but the underlying behavior was reported to Anthropic's public Claude Code issue tracker as early as August 2025. Additional reports noted that the settings file was sometimes not added to the ignore list at all, and that Claude Code could write sensitive commands to a different file that had no git protection. According to the article, those reports were all closed automatically after 60 days without activity, rather than being resolved.

In a Hacker News discussion over the weekend, Claude Code's Boris Cherny said the team is exploring ways to prevent the problem. He also argued that these settings files should essentially never be checked into source control, framing the leaks as a result of users committing files that were never meant to be shared.

Analysis and implications

The episode illustrates a recurring tension in agentic coding tools: convenience features that reduce approval friction can quietly convert transient, sensitive inputs into persistent artifacts. Agents that execute commands on a developer's behalf blur the line between what a human typed and what a tool recorded, and secrets embedded in commands are easy to overlook. Best practice would be for such tools to redact or refuse to persist credential-like strings, store only parameterized patterns, and ship repository-level ignore rules by default instead of relying on global user configuration. Secret scanning on push, which GitHub already offers, can catch some leaks, but not all credential formats.

For Anthropic, the reputational stakes are meaningful because Claude Code is among the most prominent AI coding agents, and enterprise adopters weigh security posture heavily. Competing tools that handle approvals and secrets more conservatively may draw favorable comparisons, though similar patterns could exist in other agents that persist command permissions locally. Organizations using Claude Code should audit their repositories for .claude settings files, rotate any credentials that may have been exposed, add the file to project-level ignore lists, and avoid pasting secrets directly into commands the agent runs.

The case also highlights the cost of letting security-relevant bug reports expire through inactivity policies. Whether Anthropic ships a fix quickly will likely shape how the developer community judges its responsiveness on agent safety.