If you or your organization use Anthropic's popular AI coding assistant Claude Code to develop software, you may want to check your public GitHub repositories. A seemingly harmless option designed to save developers time has also been saving sensitive passwords and security credentials in files that can accidentally end up exposed to anyone on the internet.

That's the warning from cybersecurity company Apiiro, whose researchers discovered 1,122 publicly accessible Claude Code settings files containing sensitive credentials, including database passwords, cloud service keys and tokens used to access other software systems.

The files belonged to individual developers and organizations, potentially giving unauthorized outsiders the information needed to access private databases, cloud infrastructure and other business services.

The problem stems from a familiar convenience feature. Claude Code, like other AI coding assistants, can do more than suggest programming changes.

It can also propose and execute commands on a developer's computer, such as connecting to a database to troubleshoot an application or calling an external software service. These operations sometimes require passwords or other private credentials, which can appear directly within the commands Claude Code proposes.

For security reasons, Claude Code normally asks users for permission before executing certain commands. But repeatedly approving the AI's actions can become tedious.

To avoid interruptions, users can select "Yes, and don't ask again", telling Claude Code it can run an approved command in the future without requesting permission each time.

What went wrong with Claude's 'dont' ask again' feature

Here's the catch: Rather than simply remembering that the command is permitted, Claude Code can save the entire command, including any passwords or access keys embedded within it, in a local settings file called .claude/settings.local.json.

That file is supposed to remain private on the developer's computer. Claude Code even takes steps to prevent it from being uploaded to GitHub, the widely used platform where developers store and share software code.

However, those protections don't cover every situation. If the file is already being tracked by Git, the version-control system developers use to manage changes to their code, or a project is moved or configured differently, the settings file can wind up being published alongside the code itself.

And once that happens, anyone who can access the public repository can potentially read the saved passwords and keys, even if the developer never intended to share them.

What Apiiro found

Apiiro researchers Shmulik Cohen and Matan Giladi examined 104,185 publicly accessible copies of the local Claude Code settings file across 103,617 GitHub repositories.

They found that roughly 1.1% contained what they classified as real secrets, totaling 1,379 distinct credentials in those files alone. A broader investigation that also examined historical versions of files and other records produced by AI coding tools uncovered 2,539 distinct credentials across 1,994 public repositories.

The researchers identified exposed credentials belonging to 63 organizations, ranging from small development teams and startups to established technology vendors. Among the discoveries were passwords for production databases, a cloud management API key belonging to a database provider, and credentials associated with an application handling medical records.

That doesn't mean all those credentials still worked, or that attackers successfully used them. Apiiro did not attempt to log into the affected systems or test the credentials, although one organization confirmed that an exposed key had been active. Still, the findings illustrate a potentially serious security risk: credentials embedded in an otherwise routine AI-generated command can become publicly accessible without anyone realizing it.

Be aware of the trails your AI agents leave behind

The discovery also raises broader concerns about the growing corporate reliance on AI agents that can operate software and access sensitive systems on behalf of employees.

In VentureBeat's October 2026 VB Pulse research survey on Agentic Security and Identity, 24% of 101 enterprise AI and security leaders said their agents mostly operate using shared API keys or credentials associated with people or service accounts. Another 20% reported having no automated way to detect when an AI agent takes an unauthorized action.

For organizations adopting AI coding tools, the lesson is that the security risks extend beyond what an AI agent might do while it is running. The records it leaves behind can also expose valuable information long after a task is finished. And removing an exposed settings file from GitHub may not be enough, since previous versions can remain accessible through the repository's history or copies made by other developers.

Apiiro recommends that developers and security teams search their public repositories for .claude/settings.local.json and .claude/settings.json, examine their revision histories, and revoke and replace any passwords or access keys that may have been exposed. The company also advises developers to avoid placing credentials directly inside commands that AI agents might save.

Anthropic has acknowledged the issue. Boris Cherny, the company's head of Claude Code, responded to the findings in a November 7 discussion on Hacker News, saying the team was exploring improvements, including built-in scanning for exposed credentials and additional safeguards in Claude Code's automated permission system. However, he did not announce a specific fix or release date.

Five checks from Apiiro

Apiiro’s report gives security teams these steps, in its own words:

"1. Search your GitHub organization for .claude/settings.local.json and .claude/settings.json.

2. Check each repo’s git history for the file, even if it’s gone today.

3. Rotate every credential the file has ever held.

4. Add .claude/settings.local.json to your org’s .gitignore templates.

5. Stop typing secrets into commands. Reference them as $VAR from whatever secrets manager you use, so the rule records $DB_URL, not the secret."

VentureBeat co-signs these steps for enterprises and organizations relying on Claude Code.