AI Coding Agents Security Risks: The Claude Code GitHub Leak and How to Stay Safe (2026)

AI coding agents security risks moved from theory to headline this week, after researchers found more than a thousand public GitHub files leaking real passwords and API keys. The culprit was not a hacker. It was a “don’t ask again” button that saved approved commands, secrets included, into a file developers then pushed to public repositories.

If you use an AI coding assistant, this story matters even if you have never typed a password into a terminal. A small shortcut turned into a large-scale credential exposure — and the fix is easy once you know where to look.

What Happened: 1,122 Public Files, 1,379 Secrets

On 5 November 2026, security researchers at Apiiro searched GitHub for copies of .claude/settings.local.json, the file where Anthropic’s Claude Code saves commands a user has approved with “Yes, and don’t ask again.”

The numbers were stark. Of 104,185 public copies of that file on GitHub, 1,122 contained at least one real secret — about 1.1 percent. Together they held 1,379 distinct secrets, including 379 database passwords, 43 SSH logins, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys.

Looking wider — older versions in git history, shared settings files, and saved agent chat transcripts — the researchers counted 2,539 secrets across 1,994 repositories. Sixty-three organisations were affected, and the exposed credentials included a database vendor’s admin-level cloud key and a production Azure Postgres password.

Apiiro did not test the credentials, so this is proven exposure, not proven break-ins — but every file sat on a repository’s default branch, readable by anyone, and in half of the affected repositories it had been there for at least 217 days.

How One Click Saves Your Password

Claude Code is a terminal-based AI coding assistant that can run shell commands on your behalf. Before running a command, it asks for approval. If you choose “Yes, and don’t ask again,” it saves that command as an allow rule — word for word. If the command contains a password or an API key, that secret is written into .claude/settings.local.json in plain text.

Claude Code’s documentation says the file is added to your global git ignore list the first time it is written inside a repository. That safety net failed for thousands of developers: in 539 of the 1,105 leaking repositories traced, a commit co-authored by Claude itself had changed the settings file.

This behaviour was reported before. Users filed bug reports as early as August 2025, saying approved commands with API keys were being stored word for word. Apiiro cites four such reports, all closed by an automated bot without a reply, and as of publication Anthropic had not released a patch. Apiiro also compared the documentation of 16 coding agents and found Claude Code was the only one confirmed to write the full approved command to a project file by default — but that does not mean other tools are safe.

Why Secret Scanners Missed One in Five Leaks

Many teams assume their scanners will catch any secret that reaches a repository. This leak shows that assumption is wrong. The researchers ran gitleaks and TruffleHog over all 104,185 files. Of the 1,122 files holding a real secret, gitleaks flagged 564 and TruffleHog flagged 643 — and neither flagged 215 of them, roughly one in five. The reason: many of these secrets are not keys in a recognisable format. They are passwords typed into a command, such as a database password after a flag or a token next to a public server address. Pattern-based scanners look for things that look like keys, so a plain password in a command line slips through.

What This Means for Your Team

The lesson applies to every AI coding agent. These tools act on your behalf, and acting often means running commands that contain credentials — so any tool that remembers what it did can remember a secret too. The leak is silent, and deleting the file does not undo the damage, because older versions stay in git history and in forks.

A Practical Checklist to Protect Your Projects

Use this checklist today, whether or not you use Claude Code.

1. Search your GitHub organisation for .claude/settings.local.json and .claude/settings.json. Every hit is a file anyone can read right now.
2. Search git history too. Use git log or a scanner with history scanning enabled — deleting a file does not remove it from past commits.
3. Rotate any credential you find. Assume it is compromised, even if no one has used it.
4. Add the settings files to your .gitignore. Claude Code is supposed to do this automatically, but verify it yourself in every repository.
5. Stop putting secrets in commands. Use environment variables or a secrets manager instead of typing a password or key into a shell command.
6. Never click “don’t ask again” on a command that contains a secret. If you already have, check the settings file and remove the rule.
7. Run secret scanning in your CI pipeline, not just on your laptop. A scan on every pull request catches a leaked file before it reaches the default branch.
8. Give coding agents the narrowest permissions that let them work, and keep production credentials out of development environments.

The Bigger Lesson for AI Coding Tools

AI coding agents are genuinely useful, and this incident should not scare you away from them. It should change how you supervise them. An agent that can run commands, edit files and commit code is powerful precisely because it can do things you would not want to check line by line. That power needs guardrails: ignored settings files, secrets kept out of commands, and scans that run automatically. The developers caught in this leak did nothing careless — they approved a command, clicked a button that promised convenience, and trusted a tool to handle the details. It just saved them in the wrong place.

Frequently Asked Questions

Is Claude Code itself unsafe to use?

No — the issue is a specific default behaviour, not the model. Avoid “don’t ask again” on commands containing secrets, keep the settings files out of git, and scan your repositories.

How do I check whether my repositories are affected?

Search GitHub for .claude/settings.local.json in your organisation and scan your git history with gitleaks or TruffleHog. Check older commits too — a deleted file can still leak secrets from history. If you find a secret, rotate it immediately.

Does this affect other AI coding assistants?

Apiiro compared 16 coding agents; Claude Code was the only one confirmed to write the full approved command to a project file by default. But any agent that runs shell commands can expose a secret the same way. Check your own tool’s settings and ignore files, whatever assistant you use.

The Bottom Line

AI coding agents security risks are not abstract. This week they had a number: 1,122 public files, 1,379 secrets, 63 organisations, and a median exposure of 217 days. The fix is simple and mostly free — search your repositories, rotate anything you find, keep secrets out of commands, and make sure your scanner runs on every pull request. Do that today, and the next leak headline will be about someone else’s repository, not yours.