Claude Code’s “Don’t Ask Again” Feature Leaks 2,539 Keys; GitHub Repositories of 63 Enterprises Become Public Backdoors

On November 7, 2026, security research firm Apiiro disclosed that Claude Code’s “Don’t Ask Again” feature caused 2,539 secrets to be scattered across 1,994 public GitHub repositories, affecting 63 enterprises.

Factual Reconstruction

According to Apiiro’s research, when a user chooses to “permanently allow a command,” Claude Code writes the full command text, including passwords and API keys, into the .claude/settings.local.json file. Once that file is pushed to GitHub along with the code, it becomes publicly exposed credentials. Confirmed leaked content includes 379 database passwords, 122 Supabase service keys, 23 AWS keys, and multiple SSH root login credentials, involving 63 organizations. Mainstream secret-scanning tools such as Gitleaks and TruffleHog have detection blind spots for 215 files. Anthropic has not yet made a public response. This is the second empirical blow to Claude Code’s data-leak security this year, following the email injection vulnerability.

Mechanism Breakdown

The root cause is that Claude Code persists user authorization actions directly into a local project file, and that file contains the full command text by default. When developers push a directory containing this file to a public repository, sensitive credentials are immediately exposed. The tool itself becomes a leak vector rather than the incident being merely a user operational error. The mechanism by which the settings file travels with the code repository turns a “convenience” feature of the AI coding assistant directly into a channel for enterprise asset leakage.

Industry Impact

This incident shows that AI coding assistants have systemic blind spots in enterprise security compliance. Sixty-three organizations face credential exposure because of a single tool configuration, and mainstream scanning tools failed to cover all at-risk files. This means enterprises relying on existing DevSecOps processes may remain continuously exposed to similar threats. The incident once again confirms that the way AI code generation tools integrate with version control systems may amplify rather than reduce security risk.

Strategic Judgment

(The following is analytical opinion, not a statement of fact.) From a tool design perspective, AI coding assistants need to rebalance user experience and enterprise compliance. If similar persistent authorization mechanisms are not isolated or encrypted, more organizations may reassess their dependence on a single AI code tool in the future and push for stricter code repository scanning and privilege separation strategies.