Security firm Apiiro says it found “2,539 real secrets in 1,994 public GitHub repositories” in files that AI coding agents wrote and developers committed, most of them a settings file created by Anthropic’s Claude Code, in research by Shmulik Cohen and Matan Giladi published on 5 November (Apiiro).
That file is .claude/settings.local.json. Apiiro says that when a developer picks “Yes, and don’t ask again” on a proposed command, Claude Code saves that exact command, including any password or key typed into it, to this file inside the project folder.
Business Pill · AI Agents
An evergreen Business Engineer explainer on AI agents. It teaches the general idea only and does not discuss Apiiro, Claude Code or this research.
The key insight: Apiiro says it found 2,539 real secrets in 1,994 public GitHub repositories in files that AI coding agents wrote, and 1,122 of 104,185 public copies of Claude Code’s .claude/settings.local.json hold one; about 19.2% of those files were flagged by neither gitleaks nor TruffleHog, by our arithmetic.
Apiiro says public GitHub holds 104,185 copies of the file, in 103,617 repositories, and that “1,122 files (1.1%) hold a real secret”. Together those files hold 1,379 distinct secrets: “636 provider keys and 743 passwords or tokens for public hosts”.
The firm says it found more in the file’s git history, in the shared settings.json teams commit on purpose, and in agent chat transcripts saved in repos, including exports from other tools such as aider and Cursor. It says earlier versions of the allowlist file hold “734 real secrets, in 509 repos, that appear in no current copy”. “Counting the file’s history, the shared settings file and agent transcripts (next sections), the total comes to 2,539 distinct real secrets in 1,994 repos”, it writes.
Apiiro says “63 organizations hold a real secret in a public allowlist”, mostly software companies. Its examples include a database vendor’s own cloud API key, a production Azure Postgres password and a Square production access token. It also counts “43 SSH credentials for public servers”.
Of the 1,122 .claude/settings.local.json files with a real secret that Apiiro found on public GitHub, TruffleHog flagged 643 (57.3%), gitleaks 564 (50.3%) and neither 215 (19.2%). Scanners run without verification. Data: Apiiro, 5 Nov 2026; shares ours.
How the File Ends Up Public
Apiiro says Claude Code tries to keep the file local: “When it creates the file inside a git repo, it adds it to the developer’s global git ignore list”. It says that does not cover a folder that becomes a repo later, a clone on another machine or a file already committed, and that the rule never goes into the repo’s own .gitignore.
The firm writes that “This is Claude Code’s own behavior, not the model’s”, and that it reproduced it with Opus 5.5 and Fable 5.1. It says “In 539 of the 1,105 repos with a real secret that we traced, a commit co-authored by Claude changed the file”.
Apiiro says it compared how 16 coding agents store approvals from their documentation, and that “Claude Code is the only one confirmed to write the full approved command to a project file by default”.
What Secret Scanners Missed
Apiiro ran two common open-source scanners over all 104,185 files. “Of the 1,122 files with a real secret, gitleaks flagged 564 and TruffleHog 643; 215 were flagged by neither”. The firm says the gap is passwords typed inside commands, which do not match the key formats scanners look for.
A Separate Sandbox Report
Separately, a GitHub issue opened on 7 November reports that on Linux, Claude Code’s sandbox applies its denyRead file patterns as “a start-of-command snapshot”, so a matching file created while a command runs is readable by that command (GitHub #108071). The issue, filed against version 2.1.319, carries the labels bug, has repro and area:security, and had no maintainer reply when we read it.
Disclosure and Response
Apiiro says it “reported each organization case to its owner on November 2 and 3, 2026” and that “One company confirmed its key had been live”. It says users have reported the mechanism in Claude Code’s GitHub issues since August 2025 and that “None got a reply from Anthropic”. Anthropic had not commented in the report as read.
Our Numbers
About 19.2% of the 1,122 files with a real secret were flagged by neither scanner (215 divided by 1,122), and in about 48.8% of the 1,105 traced repos a Claude-co-authored commit changed the file (539 divided by 1,105), by our arithmetic from Apiiro’s figures.
Connecting the Coverage
Claude Code added an email check 108 days after the first report of that issue (our piece), and its cloud sessions now set up repos and API keys on their own (our piece). This week Varonis showed AWS’s Bedrock could run command-and-control in a breached account (our piece), and Censys counted exposed ARTEX consoles online (our piece).
The Structural Read
As we read the report, the issue sits in a product setting rather than in a model: Apiiro says it reproduced the behaviour with Opus 5.5 and Fable 5.1 and calls it Claude Code’s own behaviour.
As we read the method section, the counts are a floor for public GitHub, not a measure of valid credentials: Apiiro says no credential was used or tested.
As we read the disclosure section, Apiiro notified the affected organizations, and the report as read contains no comment from Anthropic.
Apiiro, 5 November 2026
“Nobody meant to publish a key. The key was in a command, the command was approved, and the file was committed with everything else.”
Three Implications
FOR DEVELOPERS Apiiro advises untracking the file, rotating every credential it ever held and approving command patterns instead of literal commands.
FOR SECURITY TEAMS Apiiro advises treating agent folders such as .claude/ as secret-bearing and scanning for passwords inside commands, not only key formats.
FOR CLAUDE CODE Apiiro says Claude Code adds the file to the developer’s global git ignore list, but never to the repo’s own .gitignore.
The analysis says: “It is helping define the rules, permissions, and boundaries around frontier intelligence.”
As we read it, Apiiro’s findings concern one of those boundaries at product level: what an approval in Claude Code records and where it is stored. The analysis does not discuss Apiiro, this file or secret leaks.
What Is Not Established
Apiiro says “No credential was used or tested, and no host was contacted”, and that “Real secret” means a credential that matches a provider format or points at a public host, “not one known to be valid”. The counts come from GitHub code search on default branches between 1 and 3 November. We have not checked any of the repositories ourselves.
This Week In The AI Supercycle
Anthropic’s Reality Check, The Capital Squeeze, & The New World Order
This week’s issue: for two years the AI build-out was priced as a growthstory. This week it started being priced as a credit story.
Apiiro says it found 2,539 real secrets in 1,994 public GitHub repositories, in files written by AI coding agents; about 83.2% of them sit in current or earlier copies of the .claude/settings.local.json file that Claude Code writes when a developer chooses “Yes, and don’t ask again”. Two common scanners together missed about 19.2% of the files with a real secret, by our arithmetic.
A note on sourcing. All counts, examples and quotations are from Apiiro’s research post of 5 November 2026 and from GitHub issue #108071 of 7 November 2026. The percentages are ours. We have not checked any repository, credential or host ourselves. This is not investment advice.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
