Anthropic Claude Code Security Flaw Exposes Thousands of API Keys and Passwords in Public GitHub Repositories

The rapid integration of AI-powered coding assistants into development workflows has introduced a significant new vector for data exfiltration, as highlighted by a recent security analysis from software security firm Apiiro. The investigation reveals that Claude Code, Anthropic’s command-line AI coding assistant, has been inadvertently facilitating the exposure of sensitive credentials, including API keys, database passwords, and authentication tokens, by storing them in plain-text configuration files that are frequently committed to public version control systems.

This security oversight stems from a specific feature in the assistant’s design: the "Yes, and don’t ask again" permission setting. When users grant this authorization, the tool saves the executed shell command verbatim into a local configuration file, .claude/settings.local.json. Because developers often include sensitive credentials directly within their CLI commands, these secrets are captured and stored in a file that is not automatically excluded from git repositories by default, leading to widespread accidental leaks.

The Mechanism of the Leak

The core of the issue lies in the automation of user permissions. Claude Code is designed to assist developers by suggesting and executing shell commands. To streamline this process, the tool allows users to suppress future prompts for similar tasks. When a user opts for the "don’t ask again" functionality, the assistant records the exact command string to ensure future execution without further human intervention.

If a developer executes a command such as mysql -u admin -p 'StrongPassword123', the AI agent saves that entire string, including the password, into the .claude/settings.local.json file. While Anthropic’s documentation indicates that the tool attempts to mitigate this by adding the file to a global git exclusion list, this protection is highly localized. It applies only to the individual user’s environment on a specific machine. It does not effectively prevent the file from being added to a project’s version history if a user explicitly adds it, nor does it protect files that have already been committed to a repository before the exclusion is configured.

Consequently, when developers push their code to platforms like GitHub, these configuration files are often included in the commit. Once a file is pushed to a public repository, the credentials within it become accessible to any individual with internet access. Even if the developer later deletes the file, the sensitive data remains in the repository’s git history and propagates through every fork of the project.

Scale and Impact: Quantitative Analysis

The findings from Apiiro’s researchers paint a concerning picture of the scale of this exposure. After scanning public GitHub repositories, the security firm identified 104,185 copies of the .claude/settings.local.json file across 103,617 unique repositories. Of these, 1,122 instances were confirmed to contain at least one clear-text secret. In total, the researchers identified 1,379 distinct sensitive items.

The nature of the compromised data is particularly alarming. More than one-third of the leaked secrets—379 in total—are passwords providing direct access to databases. The inventory of exposed data also includes:

• 43 SSH private keys or login credentials for public servers.
• 42 tokens for major platforms such as GitHub, GitLab, and npm.
• 23 AWS access keys, which could grant attackers control over cloud infrastructure.

The researchers also noted that 63 organizations, ranging from small startups to established software enterprises, are among those whose repositories contain these exposed secrets. In some instances, the leaked data included high-privilege credentials, such as admin-level cloud keys for database vendors and passwords for sensitive medical-records databases.

The longevity of these leaks is another major concern. Analysis indicates that for half of the repositories containing secrets, the sensitive data had remained exposed on the default branch for at least 217 days.

Chronology of the Vulnerability

The issue is not entirely new, and its history suggests a failure in the feedback loop between the user community and the vendor.

• August 11, 2025: The first public report of this behavior was filed by a user on the official Anthropic Claude Code GitHub issue tracker. The report specifically noted that approved commands containing API keys were being persisted in plain text within settings files.
• Late 2025: Throughout the latter half of the year, at least four separate bug reports regarding this behavior were logged by the community.
• January 3, 2026: An automated triage bot, acting on behalf of the project maintainers, closed the initial report and subsequent related tickets as "not planned" due to a lack of activity over a 60-day period.
• February 2026: Apiiro researchers published their comprehensive analysis, bringing the issue back to the forefront and demonstrating that the behavior persists in the latest versions of the software, specifically Opus 5.5 and Fable 5.1.

Limitations of Current Security Tools

One of the most troubling aspects of this leak is the difficulty of detection. Many developers rely on automated secret-scanning tools like Gitleaks or TruffleHog to maintain the security of their repositories. However, these tools are primarily optimized for detecting high-entropy strings, such as standard API key formats.

Because the secrets exposed by Claude Code are often embedded within standard shell commands, they lack the distinct structural markers that security scanners are programmed to recognize. In their testing, researchers found that traditional scanners missed over 20% of the leaked files. Furthermore, because these secrets are often simple passwords or tokens appended to standard CLI utilities (like mysql -p or sshpass), they appear to the scanner as benign command-line arguments rather than sensitive credentials.

Recommended Remediation and Security Best Practices

For organizations and individual developers who may have utilized Claude Code, the recommended course of action is immediate and comprehensive. Merely deleting the .claude/settings.local.json file is insufficient, as the data persists in the git history.

Security professionals recommend the following steps:

1. Immediate Rotation: Every password, API key, and authentication token that has ever been processed through a command in Claude Code must be considered compromised. These should be revoked and regenerated immediately.
2. History Scrubbing: Developers must use tools like BFG Repo-Cleaner or git filter-repo to permanently purge the sensitive configuration files from the entire commit history of the repository.
3. Global Exclusions: Organizations should enforce stricter .gitignore policies and ensure that global git excludes are configured across all development workstations to prevent local configuration files from being tracked by version control systems.
4. Credential Management: Developers should move away from passing credentials as plain-text arguments in shell commands. Instead, they should utilize secure environment variables or dedicated secret management services (e.g., HashiCorp Vault, AWS Secrets Manager) that do not require the storage of credentials in local text files.

Broader Implications for AI Governance

The situation surrounding Claude Code underscores a broader challenge in the era of AI-driven software development. As developers offload more complex tasks to autonomous or semi-autonomous agents, the potential for "permission creep" and unintentional data exposure grows.

The fact that an automated bot closed reports regarding a clear security vulnerability highlights a breakdown in the secure software development lifecycle (SSDLC). When AI agents are granted the capability to modify the local filesystem, they effectively become privileged actors. If those agents do not prioritize security-by-default—such as by automatically ignoring sensitive configuration files or providing real-time warnings when a secret is detected in a command—they create a "shadow IT" environment that security teams are ill-equipped to police.

As AI assistants continue to gain traction, the industry will likely see a push for more robust "guardrail" implementations. This may include mandatory file-exclusion policies for agent-generated configuration files and stricter auditing of the commands that these agents are permitted to execute. Until such safeguards are standard, the onus remains on the developers to treat AI-generated logs and settings files with the same level of security scrutiny as the source code they write themselves.