Routine Prompt in Claude Code Leads to Massive GitHub Secret Exposures

It only takes one click to compromise an entire enterprise network, and for thousands of developers, that click happened inside their favorite AI coding assistant. A severe security scare has emerged after researchers discovered that a convenience feature in Claude Code is actively exposing sensitive credentials on public repositories. What started as a simple way to save time during terminal sessions is now forcing enterprise security teams into absolute overdrive.

When using Anthropic’s terminal-based coding agent, developers are frequently prompted to approve shell commands before they execute. To speed up daily workflows, many users simply click "Yes, and don't ask again." Unfortunately, this action instructs the software to write the exact approved command—including any hardcoded passwords, root logins, or API tokens—directly into a local configuration file named .claude/settings.local.json.

According to a deep dive by application security firm Apiiro, developers are then unknowingly committing this settings file to public GitHub repositories. The researchers uncovered over 104,000 copies of this configuration file in the wild, with at least 1,122 containing highly sensitive, live secrets. Automated botnets constantly scrape version control platforms for these exact JSON structures, meaning a leaked key can be weaponized before a developer even finishes their morning coffee.

Because these configuration files are nested inside standard project directories, they easily bypass standard pre-commit hooks that usually scan source code for hardcoded secrets. Understanding the fallout requires looking at how different compromised credentials impact infrastructure.

Anthropic has built a robust framework for managing tool execution, and their official security documentation clearly outlines how permissions are handled locally. However, the responsibility ultimately falls on the developer to manage their .gitignore files correctly. If the hidden .claude directory is not explicitly ignored, any command approved for permanent execution gets bundled into the next remote push.

Industry experts are now urging engineering teams to audit their commit histories immediately. As highlighted in broader AI agent security best practices, organizations must implement stricter deny rules and sandboxing environments. Security leaders should mandate immediate sweeps of all active repositories to identify and scrub these hidden directories. Relying on default local storage for automated workflows is a massive liability that modern application security teams simply cannot afford to ignore. Before you click that convenience prompt, make sure your repository isn't about to ask for a ransom.