Phoenix 24
AI coding convenience reveals a serious cybersecurity blind spot.
SAN FRANCISCO
A security investigation has uncovered thousands of exposed passwords, authentication tokens and cloud access credentials linked to Anthropic’s Claude Code, raising concerns about how artificial intelligence programming assistants handle sensitive information. The findings reveal how a seemingly routine permission setting can unintentionally compromise confidential data when developers publish their projects on GitHub.
Cybersecurity firm Apiiro identified 1,122 publicly accessible Claude Code configuration files containing 1,379 distinct secrets. The discovery followed an examination of more than 104,000 files associated with the AI-powered coding assistant.
The vulnerability centers on a feature allowing developers to approve commands without repeated confirmation. When users select the option to authorize a command permanently, Claude Code can preserve its exact contents in a local configuration file, including passwords or authentication credentials embedded in the instructions.
Although the file is intended to remain private, it can become publicly accessible when project settings are inadvertently uploaded to GitHub.
The investigation identified 379 database passwords, 43 SSH server credentials and 23 Amazon Web Services keys among the exposed information. Some credentials potentially provided access to production infrastructure, including systems associated with financial transactions and medical records.
Researchers subsequently expanded their examination to include historical repository versions, shared configuration files and saved agent conversations, identifying 2,539 distinct secrets across 1,994 public repositories.
These figures represent different investigative scopes and should not be interpreted as separate incidents.
The actual security consequences remain uncertain. Apiiro did not attempt to use the exposed credentials, meaning their continued validity could not generally be established. However, one affected organization confirmed that a reported key had remained active.
A separate investigation by GitGuardian documented 31,088 distinct secrets appearing in Claude Code configuration files across public GitHub repositories between January 2025 and early November 2026. The company reported that 5,343 credentials were valid when detected.
The findings also exposed limitations in conventional security tools. Two widely used scanners, Gitleaks and TruffleHog, failed to identify sensitive information in 215 files examined by Apiiro.
Boris Cherny, who leads Claude Code development at Anthropic, acknowledged the issue and indicated that the team was exploring additional safeguards, including automated secret detection.
The company maintains that local configuration files are normally excluded from version control. Nevertheless, researchers found circumstances in which those protections did not prevent sensitive information from entering public repositories.
The distinction is important: the findings do not establish that Anthropic’s central systems were breached or that every exposed credential was exploited.
For organizations adopting AI-assisted software development, the investigation highlights a growing challenge. Automation can accelerate programming, but it can also preserve confidential information in unexpected locations, expanding the consequences of ordinary workflow errors.
Security specialists recommend reviewing repository histories, replacing potentially compromised credentials and strengthening controls over information recorded by automated development tools.
The broader lesson extends beyond a single product. As AI agents gain greater access to corporate systems, safeguarding their operational memory and authorization records becomes an essential part of cybersecurity governance.
Where Innovation Meets Responsibility.