Claude Code's "Don't Ask Again" Feature Exposed 2,539 Credentials Across Public GitHub Repositories

AI coding assistants promise to make software development faster. Developers can ask an AI to fix bugs, connect databases, run commands and automate complicated technical tasks without manually handling every step.

But convenience has a cost when an AI tool remembers more than it should.

A cybersecurity investigation by Apiiro has uncovered thousands of exposed credentials connected to AI coding tools, including Claude Code. The problem began with a feature designed to save developers time. Instead of repeatedly asking for permission to execute a command, Claude Code could remember an approved action.

The unexpected consequence was that sensitive information inside those commands could also be saved.

For businesses, this is more than a software configuration problem. It reveals a fundamental weakness in the way companies manage AI agents that can access private systems.

1,122 Public Claude Code Files Contained Sensitive Information

Apiiro researchers identified 1,122 publicly accessible Claude Code settings files containing sensitive credentials.

These included database passwords, cloud service keys and authentication tokens used to access other software systems.

The files were associated with individual developers and organizations. That means information intended to remain private could potentially become available to anyone browsing the affected public GitHub repositories.

The broader investigation was even more concerning.

By examining historical versions of files and additional records generated by AI coding tools, researchers identified 2,539 distinct credentials across 1,994 public repositories.

The findings involved 63 organizations, ranging from startups and small development teams to established technology companies.

This is an important distinction. The problem was not limited to one developer making a careless mistake. It exposed a weakness in how AI-generated activity interacts with existing software development practices.

The Convenience Feature Behind the Security Problem

Claude Code is designed to help developers perform tasks beyond writing code.

It can suggest and execute commands on a computer, including connecting to databases, running development tools and communicating with external services.

Some commands require passwords or access keys.

Normally, Claude Code asks for permission before executing certain operations. However, developers can select "Yes, and don't ask again" to avoid repeatedly approving the same action.

This sounds reasonable.

A developer working on a database connection does not want to approve the same command dozens of times.

The problem is what happens next.

Instead of simply remembering that a particular action is permitted, Claude Code can save the entire command in a local configuration file.

That file is called .claude/settings.local.json.

If the original command contains a password or API key, the saved configuration may contain those secrets too.

A Local Settings File Can Become a Public Security Risk

The settings file is intended to remain on the developer's computer.

Claude Code includes protections designed to prevent this local file from being uploaded to GitHub.

However, those protections do not cover every situation.

If Git is already tracking the file, or a project is moved or configured differently, the file can accidentally become part of a public repository.

Git is the system developers use to record changes to software projects. One of its most useful features is that it preserves previous versions.

Unfortunately, this also creates a security problem.

Deleting an exposed file does not necessarily remove the information from the repository's history.

An attacker may still find an earlier version containing the original credentials.

This turns an ordinary development convenience into a potential entry point for unauthorized access.

2,539 Credentials Reveal the Scale of the Problem

The investigation identified 2,539 distinct credentials across 1,994 public repositories.

Approximately 1.1% of the initially examined files contained credentials researchers classified as genuine secrets, accounting for 1,379 distinct credentials in those files.

The exposed information included production database passwords, cloud management API keys and credentials associated with an application handling medical records.

One important qualification is necessary.

Apiiro did not attempt to log into the affected systems or verify whether every credential remained active. The researchers also did not establish that attackers had successfully used them.

However, one organization confirmed that an exposed key had been active.

That is enough to demonstrate that the risk is not merely theoretical.

A leaked credential can potentially provide access to business infrastructure without requiring an attacker to discover a software vulnerability.

AI Agents Are Becoming Part of the Enterprise Infrastructure

The larger issue extends beyond Claude Code.

AI agents are increasingly being given permission to interact with business software, databases, cloud platforms and internal applications.

This changes the traditional security model.

Previously, businesses mainly needed to protect employees, computers and software systems. Now they must also manage automated agents acting on behalf of employees.

VentureBeat's October 2026 VB Pulse survey of 101 enterprise AI and security leaders highlights the challenge.

24% said their AI agents mostly operate using shared API keys or credentials associated with people or service accounts.
20% reported having no automated method to detect when an AI agent performs an unauthorized action.

These figures reveal a growing gap between AI adoption and security readiness.

Businesses are deploying agents faster than they are developing systems to control what those agents can access.

The Real AI Product Is Becoming Access to Business Systems

The commercial opportunity behind AI coding assistants is straightforward.

Developers spend time writing code, testing applications, fixing errors and connecting different systems. AI agents can automate parts of this work.

That creates measurable economic value.

A developer who completes a task in 20 minutes instead of two hours can spend more time building products and solving important problems.

For software companies, this creates opportunities to sell subscriptions, usage-based services and enterprise automation.

But the more useful an AI agent becomes, the more access it needs.

An assistant that can only suggest code has limited security exposure. An agent that can execute commands, read databases and manage cloud infrastructure has a much larger potential impact.

This creates a new business requirement. AI companies must compete not only on intelligence and productivity but also on security, identity management and operational control.

Anthropic Faces Pressure to Improve Claude Code Security

Anthropic has acknowledged the findings.

On November 7, Boris Cherny, the company's head of Claude Code, responded to the discussion on Hacker News.

He said the team was exploring improvements, including built-in credential scanning and additional safeguards in the automated permission system.

However, no specific release date or completed fix was announced in the original report.

This matters commercially.

Enterprise customers need more than a powerful coding assistant. They need confidence that the software will not unintentionally expose the systems and information they are paying to protect.

Security can therefore become a competitive advantage rather than simply a technical requirement.

AI companies that make safe automation easier to manage may have an advantage when selling to larger organizations.

Small Businesses Can Turn AI Security Into a Competitive Advantage

Small and medium-sized businesses often face a difficult situation.

They want to use AI to reduce development costs, automate operations and compete with larger companies. But they rarely have dedicated cybersecurity departments.

The answer is not to stop using AI coding assistants.

It is to introduce basic security practices before automation becomes deeply embedded in business operations.

Audit public GitHub repositories.

Search organizational repositories for .claude/settings.local.json and .claude/settings.json. Check whether sensitive configuration files have been published accidentally.

Examine historical records.

Do not assume deleting a file solves the problem. Review Git history to identify whether credentials appeared in previous versions.

Replace exposed credentials immediately.

Revoke and rotate passwords, API keys and tokens that may have been exposed. Removing the public file is not enough if an attacker has already copied its contents.

Prevent sensitive files from entering repositories.

Add .claude/settings.local.json to organizational .gitignore templates. This helps prevent accidental tracking by Git.

Use environment variables and secrets managers.

Instead of typing a real database password into a command, reference an environment variable such as $DB_URL.

The AI agent can remember the command structure without storing the actual password.

Give AI agents limited permissions.

An agent working on a development project should not automatically receive unrestricted access to production databases or financial systems.

Use separate credentials for different environments and provide only the permissions necessary for each task.

These practices are relatively inexpensive compared with the potential cost of a compromised business system.

The Next AI Security Battle Will Be About Trust

The Claude Code incident highlights an important change in the economics of artificial intelligence.

AI agents are becoming valuable because they can do more than generate information. They can take action inside real business systems.

But every new capability creates another security responsibility.

A leaked password can expose a database. A compromised API key can provide access to cloud infrastructure. A forgotten configuration file can remain available long after a developer believes the problem has been fixed.

For small businesses, the opportunity is still enormous. AI can reduce operating costs, accelerate software development and help smaller teams achieve more with fewer resources.

However, productivity without security is not sustainable growth.

The next generation of successful AI businesses will need to deliver three things together: intelligence, productivity and trust.

Claude Code's exposed credentials are a reminder that the future of AI will not be determined only by what agents can do.

It will also depend on how safely businesses allow them to do it.

Claude Code's "Don't Ask Again" Feature Exposed 2,539 Credentials Across Public GitHub Repositories

Claude Code security, AI coding security, exposed GitHub credentials, Anthropic Claude Code, AI agent security, GitHub security, API key exposure, enterprise cybersecurity, AI coding agents, credential leakage, cloud security, developer security, secrets management, AI automation risks