A newly recognized 2,539 distinct secrets and techniques throughout 1,994 public GitHub repositories, tracing publicity to coding-agent configuration recordsdata, Git historical past, and saved transcripts.
Their November 5 analysis describes how Claude Code’s “Sure, and don’t ask once more” approval can persist credential-bearing shell instructions inside .claude/settings.native.json.
Uncovered materials included manufacturing database passwords, cloud credentials, API tokens, and SSH logins, affecting 63 organizations. One group confirmed its uncovered key had been reside.
Claude Code’s “Don’t Ask Once more” Function Uncovered
The leakage begins when Claude Code proposes a command containing credentials extracted from configuration recordsdata or equipped throughout troubleshooting.
Approving persistent execution shops the literal command as an allowlist rule relatively than stripping its delicate arguments.
Though Claude Code provides the settings file to a developer’s world Git ignore record when created inside a repository, that safety doesn’t journey with the mission. Individually, infostealer malware already targets Claude Code authentication artifacts.
Apiiro examined 104,185 public copies of .claude/settings.native.json throughout 103,617 repositories, discovering 1,122 recordsdata containing 1,379 distinct secrets and techniques. These included 636 provider-format keys and 743 passwords or tokens related to public hosts.
Database entry dominated: 379 database passwords and 122 Supabase service-role keys appeared alongside 103 Supabase account tokens.
Researchers additionally recognized 43 SSH credentials, together with root logins embedded in sshpass instructions, plus 23 AWS keys and 6 non-public keys in these uncovered recordsdata.
The publicity prolonged past present configuration recordsdata. Historic variations contained 734 secrets and techniques absent from present copies, whereas shared .claude/settings.json recordsdata and agent transcripts expanded the general rely. Forks reproduced credentials from 74 repositories into 211 extra copies.
These persistent artifacts create alternatives for credential-harvesting supply-chain assaults, as proven by malicious Nx packages that scanned developer environments and tried to take advantage of regionally put in AI instruments. Deleting the newest file due to this fact leaves historic publicity intact.
Detection gaps have been substantial: Gitleaks flagged 564 secret-bearing recordsdata, TruffleHog recognized 643, and neither flagged 215. Passwords following PGPASSWORD=, sshpass -p, or mysql -p continuously lacked recognizable supplier prefixes.
Apiiro’s findings due to this fact distinguish structured API-key detection from contextual command-line credential evaluation. The chance additionally reaches native endpoints: TruffleHog-based secret scanning has appeared in Shai-Hulud malware operations, demonstrating how respectable discovery utilities can help credential theft from developer workspaces and linked cloud environments alike.
Builders ought to rotate uncovered credentials earlier than cleanup, untrack .claude/settings.native.json, and add repository-local ignore guidelines.
Groups ought to examine historic commits, shared settings, transcripts, and native allowlists, then substitute literal secrets and techniques with secret-manager-backed environment-variable references.
Pre-commit and CI scanning ought to detect passwords inside instructions. Apiiro didn’t take a look at credentials or contact hosts; its “actual secret” classification signifies credible credential materials, not verified validity.
Be part of 16,000+ SOC groups utilizing ANY.RUN to streamline risk investigations and cut back handbook effort. Discover to your crew
