Using AI to Write Code? One Click Could Expose Your Passwords on GitHub

AI coding tools have made software development faster and easier. Developers can now use AI agents to write code, inspect project files and execute commands on their computers. However, these conveniences can also introduce cybersecurity risks if permissions and sensitive information are not handled carefully.

A recent cybersecurity report has highlighted a potential security issue involving Claude Code, Anthropic’s AI-powered coding tool. According to the research, publicly accessible GitHub repositories contained thousands of sensitive credentials, including database passwords, API keys and access tokens.

The risk is associated with options such as “Yes, and don’t ask again”, which allow developers to grant permanent permission for certain commands.

When a command contains a password or API key, its permission record may also contain that sensitive information. If the settings file is accidentally uploaded to a public GitHub repository, the credentials could become accessible to others.

This does not mean Claude Code automatically steals passwords or sends them to attackers. The actual risk arises when sensitive information is included in commands, saved in settings and subsequently exposed through public repositories.

What Is the Complete Claude Code Security Issue?

A report published by The Hacker News on November 7, 2026, cited research conducted by cybersecurity company Apiiro.

Researchers examined publicly available GitHub repositories containing Claude Code settings files to identify exposed credentials.

According to the report:

• Researchers examined 104,185 public settings files.
• 1,122 files contained at least one sensitive credential.
• A total of 1,379 secrets were identified in those files.

The exposed information included database passwords, GitHub and GitLab tokens, and AWS access keys.

However, researchers did not verify whether every discovered password or key was still active. Therefore, these figures should not be interpreted as 1,122 confirmed hacking incidents or successful data theft cases.

What Does Claude Code’s ‘Don’t Ask Again’ Setting Do?

AI coding agents are capable of performing more than simply generating code. With the developer’s permission, they can execute commands to connect to databases, inspect files, run development tools and prepare software projects.

When Claude Code requests permission to execute a command, the developer may approve it once. In certain situations, the developer can also choose to allow similar commands in the future without being asked again.

According to Claude Code’s official documentation, these persistent permission rules are stored in the following file:

.claude/settings.local.json

The potential problem arises when the original command contains sensitive information, such as a database password or API key.

If that command is saved as part of the permission settings, the sensitive information may also be recorded in the file. If the file is later uploaded to a public GitHub repository, those credentials could be exposed.

How Can One Click Put a Developer’s Password at Risk?

Consider a developer who regularly needs to connect to a project’s database.

To save time, the developer enters a command containing the database address and password. Claude Code asks for permission to execute it.

The developer selects the option to approve the command permanently so that the tool does not ask for permission every time.

The permission may then be recorded in the settings file. Later, the developer uploads the project to GitHub without checking all its configuration files.

If the private settings file is included in the upload, the database password could become publicly accessible.

The risk involves three main factors:

1. Sensitive information in commands: A password or API key is entered directly into a command.
2. Permanent permission: The developer allows the command to run without repeated approval.
3. Public file exposure: The settings file containing the command is uploaded to a public repository.

In other words, simply using an AI coding tool does not automatically expose a password. The problem occurs when sensitive commands are saved and their settings files are shared publicly.

What Is an API Key and Why Is Its Exposure Dangerous?

An API key can be understood as a digital access key that allows software to communicate with an online service or use its resources.

For example, an application may require an API key to connect to:

• Cloud servers
• Databases
• Payment services
• Code repositories
• Other third-party software platforms

If an API key becomes publicly accessible, another person may attempt to use it to access the associated service.

Depending on the permissions attached to the key, this could create risks such as unauthorized data access, resource consumption or changes to connected services.

However, not all API keys provide the same level of access. The potential damage depends on the service, the permissions assigned to the key and whether it remains active.

How Many GitHub Files Contained Sensitive Information?

The Apiiro research cited by The Hacker News identified several categories of exposed credentials in public Claude Code settings files.

Research Category	Findings
Public settings files examined	104,185
Files containing at least one secret	1,122
Total secrets identified	1,379
Database passwords	379
GitHub, GitLab and npm tokens	42
AWS keys	23

The research also mentioned files associated with 63 organisations. One organisation confirmed that a relevant access key was active.

However, researchers did not establish that every exposed credential was active or had been used by an attacker.

The report also described a broader analysis involving older Git records, shared settings files and agent chat logs. That analysis identified 2,539 secrets across 1,994 repositories.

These broader figures should be understood separately from the findings involving the 1,122 local settings files.

Does Claude Code Automatically Prevent These Files From Reaching GitHub?

Claude Code has a security mechanism intended to prevent its local settings file from being accidentally committed to a Git repository.

According to its official documentation, when Claude Code initially creates the .claude/settings.local.json file, it adds the file to the computer’s global Git excludes list.

This helps prevent Git from including the file in normal commits on that particular computer.

However, this protection has limitations:

• The exclusion rule applies to the developer’s local computer.
• It does not automatically add the file to the project’s shared .gitignore file.
• If the file has already been tracked by Git, the local exclusion may not prevent it from being included.
• Copies of the file on other computers or build systems may not have the same protection.

Therefore, having the word ‘local’ in a filename does not guarantee that the file can never become public.

Developers should review their repository configuration and ensure that sensitive settings are properly excluded.

Is Deleting the File Enough to Protect Your Password?

No. Simply deleting a settings file or removing a password from it may not be sufficient.

Git maintains a history of changes to files. This means that even if a password is removed from the latest version, it may remain available in older commits, repository forks or copies maintained by other developers.

GitHub’s security guidance recommends revoking or rotating exposed credentials as the first priority.

For example, imagine losing the key to your house. Finding and removing the original key does not guarantee that nobody has made a copy. Changing the lock is a more effective way to restore security.

Similarly, if a password or API key becomes public, developers should immediately revoke or replace it and then assess the repository history and other copies for exposure.

What Should Developers and IT Companies Do to Stay Safe?

Developers using Claude Code or other AI coding agents should follow several security practices to reduce the risk of credential exposure.

1. Never Put Passwords Directly in Commands

Avoid entering actual passwords or API keys directly into commands that may be saved in configuration or permission files.

Instead, use environment variables or a secure secrets manager to store sensitive credentials.

This reduces the risk of exposing actual passwords when command records are saved.

2. Review These Two Settings Files

Developers should regularly inspect the following files:

• .claude/settings.local.json
• .claude/settings.json

The first file is intended for local project settings, while the second can contain settings shared with a team.

Neither should contain unnecessary passwords, API keys or other sensitive credentials.

3. Be Careful With the ‘Don’t Ask Again’ Option

Before granting permanent permission, check exactly which command the AI tool wants to execute.

If the command contains a password, API key or other confidential information, avoid saving it in its original form.

Grant only the permissions that are genuinely necessary.

4. Check Files Before Uploading Them to GitHub

Do not review only the main source code before publishing a project.

Also inspect:

• Hidden files
• Configuration files
• Application logs
• AI agent settings
• Environment files
• Other files containing credentials

Adding private settings files to the project’s .gitignore is useful. However, if a file is already tracked by Git, simply adding it to .gitignore will not remove it from the repository history.

5. Immediately Change Exposed Passwords and API Keys

If a credential becomes publicly accessible:

• Revoke the exposed API key or password.
• Generate a replacement credential.
• Update the relevant applications and services.
• Review older Git commits and repository forks.
• Check other copies of the exposed file.

Do not assume that deleting the visible text from GitHub makes the old credential safe to use again.

6. Do Not Depend Entirely on Security Scanners

The research also highlighted limitations in automated credential detection.

Of the 1,122 files containing secrets, 215 reportedly were not detected by either Gitleaks or TruffleHog.

One possible reason is that ordinary passwords may not follow the recognizable formats used by common API key detection rules.

Security scanning remains important, but it should be combined with manual reviews and secure configuration practices.

CERT-In Also Warned About Security Risks From AI Agents

The issue is particularly relevant for Indian developers and IT companies as AI coding tools, cloud infrastructure and digital platforms become more widely used.

India’s national cybersecurity agency, CERT-In, issued an advisory titled ‘AI Agents as Attack Vectors’ on October 15, 2026.

The advisory discussed incidents involving unauthorised access to Indian organisations’ ICT systems through AI agents.

According to CERT-In, certain cases involved AI agents accessing live systems beyond the intended scope of their assigned tasks. Exposed credentials in public code repositories, application configurations and cloud roles with excessive permissions were among the security concerns discussed.

The advisory also noted that some AI-assisted attacks could progress from initial access to their final impact within hours rather than days.

These incidents are separate from the Claude Code research, but both highlight a common security concern: exposed credentials and excessive permissions can create serious risks for organisations.

What Are CERT-In’s Cybersecurity Reporting Requirements?

CERT-In, or the Indian Computer Emergency Response Team, operates under the Ministry of Electronics and Information Technology (MeitY). It is India’s national agency responsible for coordinating responses to cybersecurity incidents and issuing security alerts and advisories.

Under CERT-In’s directions issued on April 28, 2022, specified service providers, intermediaries, data centres, companies and government organisations are required to report certain cybersecurity incidents within six hours of noticing them or being informed about them.

The directions also include requirements for maintaining ICT system logs securely for 180 days.

However, this does not mean that every developer mentioned in the Claude Code research automatically has to report an incident to CERT-In.

Reporting obligations depend on the organisation, the applicable directions and the nature of the cybersecurity incident. Organisations dealing with an actual incident should consult their cybersecurity and legal advisers to determine their responsibilities.

Why Are Government Skill Development Programmes Important for Young Developers?

AI coding tools are no longer limited to large software companies. Students, freelancers and startup founders in smaller cities are also using AI to build applications and websites.

As a result, learning cybersecurity is becoming just as important as learning programming.

The central government’s FutureSkills PRIME programme promotes skill development and reskilling in emerging technology areas, including:

• Artificial Intelligence
• Cybersecurity
• Cloud computing
• Big data
• Other emerging technologies

According to MeitY figures from August 2026, more than 34 lakh candidates had registered for the programme, while over 13 lakh had completed courses and received certification. More than 86% of the candidates were from Tier-2 and Tier-3 cities.

For young developers, the message is clear: learning to generate code with AI is not enough. They should also understand how passwords are stored, how API keys are protected, which files can safely be uploaded to GitHub and what to do after a security incident.

Practical training in cloud security, secure coding and responsible AI agent usage can be particularly useful for students and technology professionals across Bihar, Jharkhand, West Bengal and other states.

Should Ordinary AI Users Be Worried About This Security Issue?

People who use AI chatbots only for general questions, information or everyday assistance do not need to assume that their mobile or laptop passwords are automatically exposed because of this report.

The issue is primarily relevant to developers and IT teams using AI coding agents with access to their computers, databases, GitHub accounts or cloud infrastructure.

If you give an AI agent permission to execute commands or access sensitive systems, reviewing those permissions and settings becomes important.

AI tools can make development faster, but the risks also depend on how much access they receive and how securely their credentials are managed.

The biggest lesson is simple: use AI to improve productivity, but do not leave your digital keys exposed. Protecting passwords, API keys and server access remains the developer’s responsibility.

Frequently Asked Questions (FAQs)

Q1. What is Claude Code’s ‘Don’t Ask Again’ setting?

It is an option that allows developers to approve certain commands permanently, so the tool does not request permission every time. The permission rule may be saved in .claude/settings.local.json.

Q2. Does Claude Code automatically leak passwords?

No. The reported risk occurs when sensitive information is included in commands, saved in settings files and accidentally uploaded to public repositories.

Q3. How many GitHub files contained sensitive information?

Apiiro’s research identified 1,122 files containing at least one secret among 104,185 public settings files examined.

Q4. What happens if an API key is exposed?

Depending on its permissions, an exposed API key could allow unauthorised access to connected services, data or resources.

Q5. What should developers do first if a password is exposed on GitHub?

They should immediately revoke or rotate the exposed password or API key, generate a replacement and then review repository history and other copies.

Q6. What warning did CERT-In issue about AI agents?

CERT-In’s October 15, 2026 advisory discussed cybersecurity incidents involving AI agents, unauthorised access to organisational systems and exposed credentials.

Q7. Do ordinary mobile users need to worry about this report?

The reported issue mainly concerns developers, IT teams and users who give AI coding agents access to sensitive systems. It does not establish that ordinary chatbot users’ device passwords are being exposed.