Researchers find passwords and keys from a coding agent's approved commands in 1,122 public GitHub files
This edition read The Hacker News's account, not Apiiro's write-up. Apiiro did not test whether the secrets still work, one notified company confirmed its key had been live, and the researchers do not say whether anyone has used them. An automated reviewer was part of the secret-counting method. Apiiro sells security products. The report says earlier bug reports were closed by a bot without a reply from Anthropic; this edition found no Anthropic statement and no confirmed fix.
What was claimed?
The Hacker News reported on November 7, 2026 that software security company Apiiro found secrets in public copies of the local permissions file written by Anthropic's coding agent. When a user picks "Yes, and don't ask again", the agent can save the exact approved command, including any password or token typed into it, to .claude/settings.local.json in the project. Apiiro's search of public GitHub found 104,185 copies of the file, of which 1,122 hold at least one secret, 1,379 different secrets in all; more than a third open a database directly. Counting older versions, the shared settings file and saved chat logs, the total is 2,539 secrets across 1,994 repositories. The agent adds the file to the user's own global git excludes, but not to the project's .gitignore, and in 539 of 1,105 traced repositories a commit listing the agent as co-author changed the file.
What does the evidence support?
Reported claim, not independently established
As coding agents gain permission to run commands, their saved settings become a new place for credentials to leak, and common scanners miss many of these: gitleaks flagged 564 and TruffleHog 643 of the 1,122 files. Of 16 coding agents whose documentation the researchers compared, this is the only one confirmed to save the full approved command in a project file by default. The researchers advise rotating every exposed credential before cleaning up.
What are the limits?
This edition read The Hacker News's account, not Apiiro's write-up. Apiiro did not test whether the secrets still work, one notified company confirmed its key had been live, and the researchers do not say whether anyone has used them. An automated reviewer was part of the secret-counting method. Apiiro sells security products. The report says earlier bug reports were closed by a bot without a reply from Anthropic; this edition found no Anthropic statement and no confirmed fix.
Claim or evidence date: 2026-11-07. Last verified: .
Colors classify evidence; they do not rank truthfulness. Explore hype versus reality →