AI Coding Agents Leak Thousands of Secrets to GitHub

A command in Claude Code inadvertently saves files with credentials and other sensitive data to public Git repositories, creating security gaps for organizations.

AI coding assistants may inadvertently be leaking thousands of secrets to GitHub public repositories, making what seem like routine interactions between developers and these tools a gaping enterprise security risk.

Research from security firm Apiiro found 2,539 credentials across nearly 2,000 public GitHub repositories, with secrets such as database passwords, cloud keys, API tokens, and SSH root logins among the exposed data, according to a recent report published online. Apiiro tracked some of the leaked data to Claude Code, which was, unbeknownst to users, copying secrets to a hidden file and committing them with the rest of the developer’s code.

Among specific secrets leaked were “a database vendor’s own admin-level cloud key, a production Azure Postgres password, a Square production token, and the owner password of a medical-records database,” Apiiro researchers Shmulik Cohen and Matan Giladi wrote in the post.

Most of the secrets belong to individual developers across 63 organizations, “from student groups to startups, software agencies, and established vendors,” they wrote.

How the GitHub Data Leak Happens

The issue stems from how coding assistants — Claude Code, in a specific case that the researchers examined — carry out certain commands. “Ask Claude Code to check a database or call an API, and the command it proposes carries the secret from your config file,” the researchers explained.

The tool will ask the user before running the command and, if the choice is “Yes, and don’t ask again,” then “it saves that exact command, secret included, to .claude/settings.local.json inside the project folder,” according to the report.

“Nothing in the repo marks that file as private, so it gets committed with the rest of the code,” the researchers explained.

The fact that a routine development task creates a security exposure is dangerous for organizations, especially because these AI coding tools are supposed to be helpful, not harmful, notes Ryan McCurdy, vice president of marketing for database security firm Liquibase.

“A developer approves a command to save time, the AI agent retains credentials as part of that approval, and those credentials can eventually end up in a public repository,” he observes via email. “Nobody intended to expose them, but the workflow made it possible.”

Dead Zone of Exposure

In the case of Claude Code, Apiiro examined 104,185 publicly accessible copies of .claude/settings.local.json on GitHub, finding that 1,122 files contained real secrets. The researchers identified 1,379 distinct secrets in those files alone, including 636 provider-specific keys and 743 passwords or tokens associated with public hosts.

Claude Code is not being overtly careless; it does try to protect files when it creates its .claude/settings.local.json file inside a Git repository, the researchers noted. The tool does this by adding the file to the developer’s global Git ignore list, which tells Git to ignore the file on that particular developer’s machine. This prevents it from being included in routine commits.

However, the protection is not built into the development project itself, and the “ignore” rule does not travel with the repository when it is cloned onto another machine, the researchers noted. “The rule never goes into the repo’s own .gitignore, so nothing travels with the project to protect it,” they wrote.

Moreover, Claude Code itself was sometimes responsible for committing the exposed files. In 539 of the 1,105 repositories containing real secrets that the researchers investigated, a commit co-authored by Claude Code had modified the affected settings file.

The action that exposes these secrets while using Claude Code appears to be a “dead zone” of sorts for developers using AI coding assistants, so they likely have no idea that they’ve just exposed a secret, observes Seemant Sehgal, founder and CEO of AI penetration testing firm BreachLock.

“A ‘don’t ask again’ prompt is a decision to write a credential into a file, and many developers clicking it likely don’t know that file exists,” he says. “Once it lands in a repository, it sits in a place many secret scanners were never built to check, which appears to be why some of these leaks slipped through.”

How to Prevent Secrets From Exposure

Apiiro contacted Anthropic about the issue before publishing the findings. After their publication, Boris Cherny, Anthropic’s head of Claude Code, said in public comments that although Claude Code historically has not done secrets scrubbing, the company is looking into what it can do to prevent the secrets exposure described by Apiiro, according to Apiiro’s report.

Those approaches may be to make sure auto mode catches the exposure, or to build in basic secrets scanning, among other ideas that Anthropic will prototype “to understand the tradeoffs” before shipping something with its next version of Claude Code, Cherny said.

Indeed, the leakage exposes how Claude Code’s protection relies heavily on a developer-specific Git setting rather than a safeguard built into the project or the AI coding tool itself, exposing a gap that can turn an ordinary command approval into a persistent credential leak.

To avoid this, Apiiro recommends that developers rotate every credential a file has ever held, and open all fields and delete every rule containing a secret, even if a file was never committed to a project. Meanwhile, security teams should treat all AI agent folders as secret-bearing on laptops as well as in repos, and add them to pre-commit and secret scanning, including history.

“As AI agents become more involved in software development, organizations need to recognize that source code isn’t the only thing they need to secure,” McCurdy observes. “Agent configuration files, transcripts, and execution histories can contain sensitive information, and traditional security checks may not catch everything.”