Claude Code Vulnerability Exposes Secrets in Public GitHub Repositories
Anthropic's AI tool saves sensitive credentials in plain text files, leaking thousands of secrets.
1Critical Credential Leakage
Anthropic's Claude Code AI assistant is inadvertently exposing sensitive credentials by saving full shell commands in plain text. When users select the 'don't ask again' permission option, the tool writes these commands into a local JSON file. Researchers at Apiiro identified 1,122 public GitHub repositories containing at least one exposed secret.
2Mechanism of the Exposure
The vulnerability stems from the .claude/settings.local.json file, which records user-approved commands to automate future sessions. Because the tool saves the command word-for-word, any password or API key typed into the terminal is captured. This file is not automatically added to project .gitignore files, leading to accidental commits into public repositories.
3Scope of the Breach
Apiiro's analysis uncovered 1,379 unique secrets across 1,122 files, including 379 database passwords and 23 AWS keys. Among the affected entities are 63 organizations, ranging from small firms to large software vendors. Some exposed files contain admin-level cloud keys and owner passwords for medical-records databases, posing significant risks to enterprise security.
4Persistence of Leaked Data
Deleting the local JSON file does not resolve the security risk because sensitive data remains in git history and repository forks. Researchers found that 211 forks of 74 repositories carry the same secrets as the originals. Half of the affected repositories had these secrets exposed on their default branches for at least 217 days.
5Failure of Security Scanners
Standard secret-scanning tools like Gitleaks and TruffleHog frequently fail to detect these specific leaks. Because passwords are often embedded within complex shell commands rather than following standard key formats, scanners miss them. In testing, neither tool flagged 215 of the 1,122 files identified by researchers as containing clear-text secrets.
6Unresponsive Bug Reporting
Users previously flagged this behavior in an August 2025 bug report, but the issue remained unaddressed. An automated bot closed that report and three others as 'not planned' after periods of inactivity. Anthropic has not provided a direct response to the researchers or the community regarding these specific security concerns to date.
7Remediation and Best Practices
Security experts advise immediate rotation of every password, token, and key that has ever been stored in the settings file. Simply cleaning up the repository is insufficient due to the persistence of git history. Organizations must treat these credentials as fully compromised and perform comprehensive audits of their entire development environment.
8Broader AI Security Implications
Claude Code is currently the only coding agent confirmed to save full approved commands by default in project files. This incident highlights the growing attack surface created by AI-integrated development tools. Developers must exercise extreme caution when granting automated permissions, as AI assistants may inadvertently prioritize convenience over fundamental security protocols.