Claude Code Exposes Secrets in Over One Thousand GitHub Projects

In early November, The Hacker News reported that Anthropic’s AI coding assistant, Claude Code, inadvertently stored users’ secret credentials in project settings files that were then committed to public GitHub repositories. When developers selected the “Yes, and don’t ask again” prompt, the entire command string—including any secrets typed—was written verbatim into a file within their project. Those files were later pushed to version‑control systems, making sensitive data publicly readable. The report identified 1,122 public copies on GitHub containing exposed passwords or API keys. This exposure was traced back to the design of the “don’t ask again” option, which lacks encryption or access controls around configuration files. The incident highlights how language models can mirror user behavior without built‑in security checks or warnings about committing confidential information into source control ¹.

The scale of the breach is notable. While the core story cites 1,122 affected repos, expert commentary notes similar patterns with other LLM assistants. In March 2023, researchers discovered over 60 public repositories holding OpenAI API keys after developers used Copilot shortcuts. That earlier episode underscored an inherent problem: large‑language models often replicate user input exactly unless explicitly constrained by safeguards. Similar issues were observed with JetBrains Rider plugins where API keys intended for local development environments ended up committed directly into public Git projects (see ²). The new Claude Code issue extends this pattern to a broader set of projects and demonstrates how seemingly innocuous UI choices can have far‑reaching privacy implications. Both incidents reinforce that developers should avoid embedding credentials directly in code and instead use environment variables or secret management services.

From a technical standpoint, the vulnerability arises because project settings are stored as plain text within the repository’s file tree. When a developer commits those files, they become part of the commit history and accessible to anyone who clones the repo. Anthropic has not yet released a patch for the feature; however, users can mitigate risk by disabling “don’t ask again” for commands containing secrets or by manually removing any sensitive data from configuration files before pushing changes. Developers are advised to audit recent commits for exposed tokens and rotate compromised keys immediately.

Security experts emphasize that the incident is more than a single mistake—it reflects systemic gaps in how AI assistants handle confidential information. The fact that a commercial product like Claude Code can store arbitrary command strings verbatim points to a design choice prioritizing convenience over security. While it may streamline coding workflows, it simultaneously opens a vector for accidental credential leakage into public source control. In practice, such leaks could enable attackers to hijack accounts, inject malicious code, or compromise downstream systems that rely on exposed API keys.

The broader industry reaction underscores the importance of building LLMs with built‑in checks against storing secrets. Some vendors have begun restricting rate limits across all models after earlier abuse patterns emerged following GPT‑3 Turbo releases. These measures aim to reduce misuse but do not address the root issue: developers still need to adopt secure practices when using AI tools. As the field evolves, best‑practice guidelines increasingly recommend that secret handling be separated from code generation—using dedicated vaults or environment variables rather than plain text files.

In conclusion, Anthropic’s feature has already affected 1,122 GitHub projects, exposing passwords and API keys worldwide. The episode serves as a cautionary example of how user interface choices can undermine online privacy if not paired with robust safeguards. Developers should review recent commits for hidden credentials, rotate any compromised tokens, and consider disabling “don’t ask again” for commands containing sensitive data until more secure mechanisms are in place.