Claude Code Flaw Exposes Thousands of Passwords on GitHub
San Francisco, Saturday, 7 November 2026.
A security flaw in Anthropic’s Claude Code exposed over 2,500 plaintext credentials across public GitHub repositories, highlighting growing supply-chain risks as enterprises rapidly adopt autonomous AI tools.
The Flaw and Its Discovery
Cybersecurity researchers at Apiiro uncovered a critical vulnerability in Anthropic’s Claude Code AI assistant that exposed over 2,500 plaintext credentials across nearly 2,000 public GitHub repositories [1][3]. The issue stems from a design flaw in the platform’s ‘Don’t Ask Again’ command-approval feature, which automatically saves hardcoded secrets—such as API tokens, database passwords, and private encryption keys—into plaintext configuration files [1][3]. This vulnerability was first documented in a GitHub bug report (issue #5544) filed on August 11, 2025, which highlighted that approved shell commands containing sensitive data were stored verbatim in the .claude/settings.local.json file [1]. Despite the report’s filing, an automated bot closed the issue on January 3, 2026, as ‘not planned’ after 60 days of inactivity, leaving the flaw unaddressed for months [1].
Scope and Impact of the Vulnerability
Apiiro’s investigation revealed that 1,122 public copies of the .claude/settings.local.json file contained at least one secret, with 2,539 exposed credentials identified across 1,994 public repositories [1][3]. These secrets included 379 database passwords, 43 SSH logins, 42 GitHub/GitLab/npm tokens, and 23 AWS keys, spread across 63 predominantly software organizations [1]. The security firm also found that in 539 out of 1,105 traced repositories, commits listing Claude as a co-author had modified the settings file, indicating that the AI assistant itself often committed the vulnerable file to repositories [1]. The exposure is compounded by the fact that simply deleting the local settings file does not remove historical leaks from Git history or repository forks, necessitating a full credential rotation before cleanup [1].
Anthropic’s Response and Industry Implications
As of November 7, 2026, four related GitHub bug reports regarding Claude Code’s handling of API keys and tokens in settings files were closed by an automated bot without any response from Anthropic, despite the ongoing exposure of sensitive data [1]. This passive approach contrasts with Apiiro’s recognition as a leader in Agentic Development Security (ADS) in The Forrester Wave™ report for Q4 2026, underscoring the growing urgency for robust security frameworks in AI-driven development [4]. The incident highlights broader supply-chain risks as enterprises rapidly adopt autonomous AI tools like Claude Code, which integrate deeply into development workflows without adequate safeguards [1][4]. Anthropic’s recent expansion of security and compliance integrations—now exceeding 100 partners—suggests a belated recognition of the need for governance, though critics argue the response has been reactive rather than proactive [5].
Mitigation and Future Considerations
Industry experts emphasize that the Claude Code flaw is not an isolated incident but part of a larger trend of supply-chain vulnerabilities exacerbated by rapid AI adoption in enterprise environments [GPT]. Organizations leveraging AI assistants must prioritize credential governance and adopt automated secret-scanning tools like TruffleHog, which previously flagged over half of the exposed .claude/settings.local.json files during the Shai-Hulud worm campaign in September 2025 [1][alert! ‘historical context may not fully capture current mitigation tools’]. The Forrester recognition of Apiiro’s Guardian Agent—a control plane designed to secure multiple coding agents and models—offers a potential pathway for mitigating such risks, though widespread adoption remains a challenge [4]. For now, enterprises must treat this flaw as a wake-up call, implementing strict access controls and automated monitoring to prevent similar exposures in their AI-driven development pipelines.