Claude Code Exposed Live Credentials From 63 Organizations via GitHub
What happened
Researchers at Apiiro published findings showing that Claude Code is accidentally exposing secrets all over GitHub. More than 100,000 public repositories contain the tool's local settings files. Roughly 1,100 of those files from 63 named organizations hold live credentials. The exposed secrets include database passwords, API tokens, and private keys that were still active at the time of discovery. Claude Code, Anthropic's AI coding assistant, stores approved shell commands in a local settings file called .claude/settings.json. When developers embed credentials directly in those commands, the file captures them verbatim. The tool relies on a user-level exclusion rule to prevent the file from being shared publicly. That rule does not apply automatically inside a code repository, making accidental exposure easy. Anthropic had received related bug reports before the public disclosure and closed them without taking corrective action, a decision that has drawn criticism from the security research community. This incident follows a pattern of AI coding tool credential exposure. Related findings include the AI Coding Agents Leaked Sensitive Screenshots From 343 Organizations to Public GitHub report. The broader governance gap is documented in AI Coding Tools Are Privileged Agents. Most Governance Programs Don't Treat Them That Way.
Why it matters
- ·Enterprises that classify AI coding assistants as low-risk productivity tools rather than privileged systems with access to credentials face a direct gap in their third-party AI vendor controls. Live secrets exposed from 63 organizations confirm the risk is active, not theoretical. Affected companies may face breach notification obligations under the GDPR or comparable state laws depending on what data the exposed credentials protected.
- ·Anthropic closed related bug reports without action before public disclosure. This weakens any vendor risk program that relies on the vendor to surface or remediate security issues. Compliance teams that have not independently tested AI coding tool configurations cannot assume their vendor will flag problems first.
- ·Developers routinely embed credentials in commands to streamline their workflows. AI coding tools that store those commands create a persistent record of sensitive material. That record sits outside normal secrets management programs. This exposure pattern will recur across any AI tool that logs approved commands, instructions, or context in local or repository-accessible files.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Search your organization's public and private repositories immediately for `.claude/settings.json` files or equivalent Claude Code configuration files, and audit any found for embedded credentials.
- ☐Rotate all credentials found in exposed Claude Code settings files and check access logs for those credentials to determine whether unauthorized use occurred.
- ☐Update your secrets management policy to explicitly prohibit embedding credentials in commands approved for AI coding tools, and add a repository scanning rule that flags AI tool configuration files before any push to a shared repository.
- ☐Review your vendor risk assessment for Anthropic and other AI coding tool providers to determine whether their incident response and bug disclosure practices meet your vendor notification requirements. Document whether your current contracts require vendors to notify you when security reports about their tools are closed without remediation.
- ☐Extend your AI tool acceptable use policy to classify AI coding assistants as systems with privileged access to developer credentials, not general productivity software, and require a data boundary review before approving any such tool for use on production codebases.
What to watch next
Anthropic has not yet announced a remediation plan or a timeline for addressing the underlying design issue in Claude Code's settings file handling. Compliance teams should monitor whether the vendor issues a formal security advisory, changes the tool's default behavior, or publishes guidance for affected organizations. Regulators focused on software supply chain security are paying attention to AI coding tool credential exposure. Future vendor risk assessments will likely need to account for how AI developer tools store and protect operational configuration data. Teams should also watch for enforcement signals from data protection authorities in jurisdictions where the exposed credentials protected personal data, particularly under the GDPR.