A review by the security company Apiiro has found that a feature in Anthropic's Claude Code tool has been leaking credentials into public code repositories. The option, labeled Don't Ask Again, allows the agent to skip repeated permission prompts, and in practice it led to passwords and other sensitive values being written into files that were later pushed to GitHub. The firm counted 1,122 public files containing exposed secrets tied to the behavior.
The finding highlights a tension at the heart of agentic coding tools. Features designed to reduce friction can quietly widen the attack surface, because the agent may record configuration details or credentials in plain text without a user fully realizing it. Once such a file reaches a public repository, the secret is effectively disclosed, even if it is deleted later, since history and forks can preserve it.
The report arrives as developers increasingly rely on coding agents for everyday work, often granting them broad access to local projects and version control. Security researchers have repeatedly warned that these tools need stricter defaults around secret handling. Apiiro's disclosure adds a concrete example of how a small usability decision can produce a large-scale exposure.
Anthropic has not publicly detailed any remediation in the report. Developers who used the Don't Ask Again option are advised to audit their repositories for committed credentials and rotate any keys that may have been exposed. The incident is likely to intensify scrutiny of permission models in AI coding assistants.