A shortcut button in Anthropic's coding tool exposed 2,539 passwords and keys on GitHub, researchers say

For companies letting staff use AI coding agents, this week's risk is not a rogue AI. It is a convenience button. Security firm Apiiro says Claude Code, Anthropic's coding agent, saved any passwords and access keys typed into a command in plain text when developers clicked "Yes, and don't ask again" to approve it.

Many of those files then ended up on GitHub, the public code-sharing site. Apiiro counted 2,539 distinct secrets across 1,994 public projects, including database passwords, cloud access keys and server logins. Sixty-three organizations were affected, from startups to software agencies and established vendors.

Anthropic has acknowledged the gap. But as of reporting on November 9, it had not released a fix. Until it does, finding and changing the exposed credentials is the customer's job.

How a time-saving click became a leak

Claude Code asks permission before it runs commands on a developer's computer. Choosing "don't ask again" writes the approved command into a small settings file inside the project, so the tool skips the question next time. If that command contained a typed-in password, the password is saved too, unredacted.

Claude Code tries to keep the file private by adding it to an exclusion list on the developer's own machine. That protection does not travel with the project. It fails when the project is copied to another computer, when a folder later becomes a shared project, or when the file was already being saved to the project's history.

Privacy Guides adds another gap: Claude Code's built-in instructions for saving work exclude standard password files, but not its own settings file. So the AI itself can publish it.

Apiiro examined 104,185 public copies of the file, collected November 1 to 3. About 1.1%, or 1,122 files, held at least one real secret. That came to 1,379 distinct values, including 379 database passwords, 43 server logins and 23 Amazon cloud keys. Older saved versions, shared team settings and saved agent chat logs pushed the total to 2,539.

The examples should worry any risk officer. They include a database vendor's cloud key with management rights, a software agency's live Square payments token and the owner password for a medical-records app's database. In half the affected projects, the file had sat in public for at least 217 days.

What is proven, and what isn't

The research shows exposure, not confirmed theft. Apiiro did not test whether the credentials still work. One organization it notified did confirm its exposed key had been live.

The data also comes from a single company that sells code-security products. The Cloud Security Alliance, an industry group, said in a November 8 research note that it had not independently replicated the findings. Apiiro used an AI reviewer to help screen likely secrets, iTWire reported.

Anthropic and Apiiro disagree on who is at fault. Boris Cherny, who heads Claude Code, wrote on Hacker News that the file is not meant to be shared and that exposed copies were likely committed by hand. Apiiro counters that commits co-written by Claude changed the file in 539 of 1,105 traced projects. iTWire notes that does not prove Claude added every secret.

Apiiro also says Claude Code stood out. Of 16 AI coding agents it reviewed, only Claude Code was confirmed to save full approved commands to a project file by default. Apiiro reproduced the behavior on Anthropic's latest models and says it comes from Claude Code itself, not the underlying AI model.

The warning signs were not new. Users have reported the plaintext storage on Anthropic's public issue tracker since August 2025, iTnews reports. One report was closed by an automated process in January 2026 with no reply from Anthropic staff, according to the Cloud Security Alliance. Apiiro says other related reports were also closed automatically.

What buyers should do now

Cherny said Anthropic would prototype built-in secret scanning and changes to its automated approval mode. He cautioned those steps might not fully solve the problem. When a reader pointed out the automated mode could expose secrets too, he replied, "Yeah good catch."

Companies cannot assume their existing leak checks will catch this. Two widely used free scanners, Gitleaks and TruffleHog, missed about half and 43% of the affected files respectively. 215 files slipped past both. The tools hunt for known key formats, not passwords typed inside commands.

The Cloud Security Alliance's advice to security chiefs starts with rotation: replace any credential that ever appeared in such a file before cleaning anything up. Deleting the file is not enough, because copies persist in old versions, copied projects and backups. The group also urges treating AI agents' working folders like password files in data-protection rules.

It also suggests new procurement questions for AI tool vendors. How are standing approvals stored? Are secrets stripped out? Is exclusion from shared projects enforced, or left to each developer's machine?

The wider lesson reaches beyond one product. As AI agents get more freedom to act, the shortcuts that cut down approval prompts become security decisions. Every "don't ask again" is a standing permission, and buyers will increasingly judge agent tools on where those permissions end up.