Claude Code Security Vulnerability Exposes Thousands of API Keys and Passwords in Public GitHub Repositories

The rapid integration of AI-powered coding assistants into professional development workflows has introduced a significant new vector for data exfiltration, as revealed by a comprehensive security audit conducted by the software security firm Apiiro. The investigation has uncovered that Anthropic’s AI coding assistant, Claude Code, has been inadvertently facilitating the exposure of sensitive credentials—including database passwords, AWS access keys, and proprietary API tokens—by logging them in plain text within project configuration files. These files, specifically .claude/settings.local.json, are frequently being pushed to public GitHub repositories, rendering the sensitive information accessible to anyone with an internet connection.

The Mechanism of the Leak

At the core of the issue is a design choice in Claude Code regarding permission management. When the AI agent requests authorization to execute shell commands, users are presented with a prompt that includes an option labeled "Yes, and don’t ask again." Selecting this option instructs the tool to store the command—verbatim—within a local settings file to automate future executions.

Because the tool records the command exactly as it was typed by the developer, it captures not only the intended operation but also any sensitive arguments passed within that command. If a developer runs a command like mysql -u admin -p [password] or export AWS_SECRET_ACCESS_KEY=[key], the AI agent saves that entire string, including the cleartext password or key, into the .claude/settings.local.json file. While Anthropic has implemented measures to prevent these files from being tracked by git in certain configurations, the researchers found that these protections are often insufficient or misapplied, leading to the accidental commitment of these files into version control systems.

Chronology of the Disclosure and Neglect

The security implications of this behavior were not entirely unknown to the developer community prior to the Apiiro report. Evidence suggests that the issue has been lingering in the background of the development cycle for months.

• August 11, 2025: The first documented bug report regarding this specific behavior was filed on the official Claude Code GitHub repository. The report highlighted that approved commands containing API keys and tokens were being stored in settings.local.json.
• Late 2025: Throughout the latter half of the year, several similar reports were filed by users, expressing concern over the persistence of secrets in project directories.
• January 3, 2026: An automated triage bot, acting on a lack of activity, closed the initial bug report as "not planned."
• February 2026: Following a comprehensive audit, Apiiro disclosed that at least 1,122 public files contained active secrets, prompting a renewed focus on the vulnerability. As of the most recent findings, four separate reports regarding this issue have been closed by automated systems without substantive engagement from the Anthropic engineering team.

Quantitative Scope of the Exposure

The scale of the data exposure is substantial. Apiiro’s analysis of public GitHub repositories identified over 100,000 instances of the Claude settings files. While the majority of these were benign, 1,122 of them contained at least one confirmed secret. In total, researchers identified 1,379 unique secrets, ranging from low-level API tokens to high-privilege administrative credentials.

The breakdown of the exposed data highlights the severity of the potential impact:

• Database Credentials: Over one-third of the identified secrets provided direct access to databases, including 379 unique database passwords.
• Infrastructure Access: 43 SSH logins for public-facing servers were discovered, potentially allowing attackers to establish persistent backdoors into corporate infrastructure.
• Cloud Keys: 23 AWS access keys were identified, which could allow for the provisioning of unauthorized cloud resources or the exfiltration of data from S3 buckets.
• Third-Party Integration Tokens: 42 tokens related to platforms like GitHub, GitLab, and npm were found, which could facilitate supply chain attacks by allowing attackers to push malicious code to authorized repositories.

The researchers also noted that the problem is compounded by the nature of git history. Simply deleting the file from the current repository does not remove the secret from the commit history. Furthermore, because these files are often contained within repository forks, the vulnerability propagates far beyond the original project, creating a "multiplier effect" that makes remediation significantly more difficult.

The Limitations of Automated Detection

One of the most alarming aspects of this discovery is how easily the leaked secrets evade standard security tooling. Most enterprise-grade secret scanners, such as Gitleaks or TruffleHog, rely on pattern matching to identify known formats of keys or tokens. However, because Claude Code saves these secrets as part of natural shell commands, they often lack the distinct formatting of a standard API key.

When the researchers tested these tools against the exposed files, the results were sobering. Gitleaks flagged only 564 of the 1,122 compromised files, and TruffleHog identified 643. Alarmingly, 215 of the files—containing actual, high-value secrets—were ignored by both tools. The researchers concluded that the "human-in-the-loop" nature of the commands makes them appear as standard command-line syntax, causing automated scanners to treat them as false positives or irrelevant data.

Broader Implications for AI-Assisted Development

The situation surrounding Claude Code serves as a microcosm for the broader security challenges facing AI-assisted development tools. As organizations rush to integrate LLM-based coding agents to boost productivity, they are often bypassing traditional security governance models.

Security analysts emphasize that the core issue is a conflict between developer convenience and security hygiene. By prioritizing a "don’t ask again" workflow, the tool encouraged developers to trade security for speed. This incident underscores the necessity of "Secure by Design" principles in AI development. If an AI agent requires persistent permissions, it should be architected to store those credentials in secure, encrypted vaults—such as the operating system’s keychain or dedicated secret management services like HashiCorp Vault—rather than plain-text JSON files residing in the project directory.

Furthermore, the lack of human intervention in managing the GitHub issue tracker for the project has sparked a broader conversation regarding the responsibility of AI vendors. While open-source projects often rely on automated triage, the sensitivity of security-related bugs requires a manual review process that ensures these vulnerabilities are addressed before they are exploited in the wild.

Recommendations for Mitigation

For organizations currently utilizing Claude Code or similar AI agents, the security community advises a multi-step remediation strategy:

1. Immediate Rotation: Treat any secret that has ever been present in a settings.local.json file as compromised. All passwords, API keys, and tokens found in these files—or even potentially exposed in them—must be rotated immediately.
2. Audit Version History: Removing the file from the current directory is insufficient. Security teams must perform a "git rewrite" or use specialized tools like BFG Repo-Cleaner to scrub the entire commit history of the repository.
3. Implement Global Exclusions: Developers should ensure that .claude/settings.local.json is added to their global git ignore list, though they should be aware that this does not retroactively secure files that have already been pushed to a remote server.
4. Adopt Secret Scanning with Context: Given that standard scanners are failing to catch these leaks, organizations should implement custom, context-aware scanning rules that specifically look for patterns associated with AI coding agent configuration files.
5. Policy Enforcement: Engineering managers should implement policies that restrict the use of AI agents in environments where high-privilege credentials are present, or require that agents run in isolated, sandboxed containers that do not have access to production secrets.

The discovery by Apiiro highlights that as we empower AI to write and manage code, we must simultaneously empower it with the guardrails necessary to protect the infrastructure upon which that code runs. Without a fundamental shift in how these tools handle sensitive configuration data, the risk of "AI-assisted leaks" will likely continue to grow, posing a persistent threat to software supply chain security.