Photo by Markus Spiske on Pexels
If you’ve ever clicked “Yes, and don’t ask again” on an AI assistant, you might have accidentally treated the entire internet to an open-bar party stocked with your company’s most sensitive API keys and database passwords.
Security researchers at Apiiro have dropped a rather uncomfortable truth bomb: Anthropic’s hyped-up coding assistant, Claude Code, has been quietly collecting developer secrets and stashing them neatly into public GitHub repositories. Out of over 104,000 scanned copies of a seemingly innocuous file named .claude/settings.local.json, roughly 1,122 public repositories are currently hosting about 1,379 unique, unmasked secrets. That is roughly 1.1% of the files, which mathematically proves that Murphy’s Law applies just as strictly to artificial intelligence as it does to human error.
A Diary of Bad Decisions
Here is how the digital trap works. When developers type high-privilege commands into their terminals—complete with hardcoded passwords or API tokens—and casually click Anthropic’s tempting “don’t ask again” prompt, Claude Code dutifully saves the exact command word-for-word into a local settings file.
The real kicker? In about half of those infected repositories, these ticking time bombs have been sitting out in the open for at least 217 days. The loot includes 379 direct database passwords, 43 SSH logins for public servers, various tokens for GitHub, GitLab, and npm, and 23 AWS keys. Among the unfortunate victims are 63 organizations, predominantly software companies. The crown jewel of embarrassing leaks? A database vendor’s own admin-level cloud key and the owner password for a medical-records database. Brilliant.
The Blame Game and the Bot Bureaucracy
Anthropic’s head of Claude Code, Boris Cherny, hopped onto Hacker News to defend the AI’s honor, pointing out a few technicalities. According to Cherny, the file was always meant to stay local, and Claude automatically adds it to global git excludes to protect users from themselves.
Of course, there is a minor catch in that grand design: Claude never actually adds the file to a project’s own .gitignore. That means the protection doesn’t travel with the project if a developer manually commits it—something the AI itself apparently helped with in 539 repositories by acting as a co-author on the commits. Furthermore, users had tried reporting this exact bug back in August 2025, only to be ghosted by an automated bot that ruthlessly closed the reports for inactivity. Talk about cold, algorithmic indifference.
Time to Do the Walk of Shame
If you think you can just delete the offending file and call it a day, think again. Git history keeps receipts forever, meaning older versions and repository forks will still hold your digital keys to the kingdom.
Security researchers advise doing the digital equivalent of a frantic walk of shame: rotate every single password, token, and key this file has ever touched before you even bother cleaning up the repository. As for Anthropic, they are reportedly looking into building basic secret scrubbing into future updates. Until then, maybe treat your AI assistant less like a trusted confidant and more like that one coworker who accidentally replies-all to the entire company with their vacation Spotify playlist.
Source reference: slashdot_org
Disclaimer: This article was generated and formatted with the assistance of Artificial Intelligence.
