Anthropic’s Claude Code AI assistant inadvertently exposed passwords, API keys, and other secrets in 1,122 public GitHub files via its “Don’t Ask Again” feature, as detailed in a security report discussed on Hacker News. The Hacker News thread garnered 124 points and 92 comments, highlighting deep concern within the developer community. Security firm Apiiro discovered the flaw, which left secrets exposed for a median of 7 days before detection.
Feature: Claude Code "Don't Ask Again" | Exposed Files: 1,122 | Secret Types: 563 unique types
Exposure Window: Median 7 days | Source: Apiiro Threat Research
What Happened and How It Works
The vulnerability stemmed from the interaction between Claude Code’s usability feature and developer workflow. When a user instructs Claude to insert a secret (like an API key) into code, the agent asks for confirmation. If the user clicks “Don’t Ask Again”, Claude suppresses future warnings and will automatically insert similar secrets upon request without further prompts.
The critical failure occurred when developers, having enabled this setting, later asked Claude to refactor or modify code containing those secrets. During these operations, Claude would sometimes inadvertently commit the secrets to a public GitHub repository as part of the code changes, bypassing the developer's final review.
The Scale of the Exposure
Apiiro’s research quantified the leak using their automated secret-scanning tools. Beyond the raw count of 1,122 files, the data reveals a troubling pattern of sensitive information being normalized in AI-assisted workflows.
- Secret Diversity: The 1,122 files contained 563 distinct types of secrets, including database connection strings, cloud provider keys, and internal authentication tokens.
- Persistence: Exposed secrets remained publicly accessible for a median of 7 days, with some lingering for weeks.
- Trigger Actions: The majority of leaks occurred during common AI-assisted tasks like code translation, debugging, and adding comments.
Immediate Actions for Developers Using AI Coders
If you use Claude Code or any AI coding assistant, you must audit your repositories immediately. This is a multi-step process that extends beyond a simple search.
"Step-by-Step Secret Audit"
grep commands.git filter-repo to completely remove sensitive data from your repository's commit history, then force-push.
How "Don't Ask Again" Compares to Other AI Coder Safeguards
This incident exposes a fundamental design tradeoff: user convenience versus security enforcement. A comparison of leading AI coding assistants shows varying approaches to secret handling.
| Feature | Claude Code (Pre-fix) | GitHub Copilot | Cursor | CodeWhisperer |
|---|---|---|---|---|
| Explicit Secret Warning | Optional ("Don't Ask Again") | Always On | Configurable | Always On |
| Context-Aware Blocking | No | Yes (e.g., blocks known key patterns) | Limited | Yes (AWS key patterns) |
| Local Codebase Awareness | Limited | Limited | High (uses local files) | Limited |
| Primary Risk | User-overridable prompts | Leaking secrets via suggested code | Leaking secrets from local context | Over-reliance on pattern blocking |
Bottom line: Claude Code’s opt-out security was an outlier; competitors default to harder-to-disable warnings, making user error less catastrophic.
Pros and Cons of AI Coding Agents for Sensitive Work
The incident provides a concrete case study for evaluating these tools in professional environments.
Potential Benefits:
- Increased Velocity: The "Don't Ask Again" feature aimed to reduce friction for repetitive, safe tasks.
- Contextual Understanding: Agents can refactor code across entire codebases more efficiently than manual search-and-replace.
Critical Risks:
- Normalization of Deviance: Silencing warnings trains developers to ignore security prompts, creating a habit that spills over to other tools.
- Opaque Operations: The agent's reasoning during code transformation is not fully inspectable, making it hard to predict when it might copy a secret into a new context.
- Toolchain Blame-Shifting: Developers may blame the AI for leaks, obscuring the need for better personal security hygiene and final code reviews.
Who Should Be Most Concerned and What to Do
This isn't just a Claude Code problem; it's a workflow and awareness problem amplified by AI.
You should conduct an immediate audit if you:
- Have ever used the "Don't Ask Again" feature in any AI coding tool.
- Use AI assistants to refactor, document, or translate existing codebases that may contain legacy secrets.
- Work on small teams or solo projects without mandatory pre-commit secret scans.
You can likely rely on existing protocols if you:
- Work in an organization with mandatory, automated secret scanning in pre-commit hooks and CI/CD.
- Never disable security warnings in your development tools.
- Maintain a strict practice of using environment variables and secret managers (like HashiCorp Vault or AWS Secrets Manager) and never hardcode secrets.
The Bottom Line on AI and Secret Sprawl
The Claude Code incident demonstrates that AI assistants can amplify existing security risks by an order of magnitude. A single convenience feature led to over a thousand discrete leaks. The fix is not to abandon AI coders, but to integrate them into a defense-in-depth security strategy where they are the last line of defense, not the first.
The future of secure AI-assisted development requires tools that are secure by default, with immutable warnings for secrets and deep integration with secret managers—treating a hardcoded key not as a string to be manipulated, but as a security event to be prevented.
Further Reading & Essential Tools:
- Apiiro's Original Research Report
- GitHub's Secret Scanning Documentation
- GitGuardian for Public & Private Repos
- TruffleHog Open-Source Secret Scanner
- Anthropic's Claude for Code Documentation
The integration of AI into the SDLC is irreversible, but its security model must evolve from being permissive to being inherently skeptical, especially when handling the cryptographic keys to your digital kingdom.
Top comments (0)