Claude Code Is Leaking Secrets to GitHub, and a New Wave of Agent Security Tools Is Responding

Claude Code has been silently leaking database passwords, API tokens, and root credentials onto public GitHub repositories, and security researchers say thousands of secrets are already exposed. The vector is mundane: a settings file that users don't realize they're committing.

Researchers at Apiiro found that when a user selects the "Yes, and don't ask again" option for automated shell commands in Claude Code, the approval gets written into a local settings file. That file is not excluded from version control by default, so developers pushing their project to GitHub are dragging those settings, and any sensitive values baked into them, along for the ride. The full breakdown is documented by Ars Technica.

Why it matters

This is not a sophisticated supply-chain attack. It is a defaults problem, the most dangerous kind, because it scales with adoption. The more teams ship with AI coding agents, the larger the blast radius of any misconfigured default.

The timing also matters. Three separate agent security tools surfaced on Hacker News the same day: Antelog, which blocks AI coding agents from running dangerous or unauthorized shell commands, and I Access Auditor, which surfaces and revokes what your coding agents can actually reach. Separately, a new benchmark called MemoryDojo is stress-testing poisoning attacks through LLM agent memory, pointing to a broader reckoning with agent-layer trust boundaries.

What changes in practice

• Settings files are the new.env files. Any file an agent writes to persist approvals or configuration must be treated as potentially sensitive and excluded from version control.
• "Don't ask again" is a footgun at scale. Convenience features that suppress prompts are accumulating permissions silently. Teams need visibility into what those approvals actually encode.
• The agent permission layer is now a real attack surface. Memory poisoning benchmarks like MemoryDojo signal that researchers are treating agent state, not just model outputs, as something adversaries will target.
• Tooling is catching up fast. Command-level blockers and access auditors are moving from nice-to-have to baseline hygiene for any team running autonomous coding agents in CI or against production credentials.

How to use it

1. Audit immediately. Search your repos for Claude Code settings files (typically .claude/settings.json or similar). Rotate any credentials found.
2. Update.gitignore. Add Claude Code settings paths the same way you would .env. Do this at the project template level so new repos inherit it.
3. Review "don't ask again" approvals. Treat any persisted shell-command approval as a standing permission grant. Revoke and re-evaluate anything that touches secrets, network calls, or file writes outside the project root.
4. Evaluate a command-level guardrail. Tools like Antelog sit between the agent and the shell. For teams running agents with broad filesystem or network access, a blocklist of dangerous command patterns is now a reasonable default.
5. Watch the MemoryDojo findings. If your agents use persistent memory or tool-call history, poisoning via injected tool outputs is the next vector to model in your threat assessment.

The Claude Code leak is a reminder that agent security failures rarely look like sci-fi: they look like a checkbox that writes to a file that gets committed by a developer who was focused on shipping.