Security researchers at Apiiro found 2,539 apparent credentials across 1,994 public GitHub repositories, highlighting a new leak path created by AI coding agents and the local files they use to remember permissions and execution context.
The research focused heavily on Claude Code’s .claude/settings.local.json file. When developers approve commands and choose not to be asked again, literal command strings can be written into that file. If a command contains a token, password or connection string, the credential can be committed with the rest of the project.
Apiiro identified 1,122 current files containing what it classified as real secrets, plus additional exposures in Git history, shared settings and agent transcripts. Researchers said 539 of 1,105 traced repositories contained a commit coauthored by Claude. They also found 215 files that were not flagged by either Gitleaks or TruffleHog.
Apiiro did not use or test the credentials. It classified a value as a real secret when it matched a provider pattern or pointed to a publicly reachable service, so the findings should be read as exposure evidence rather than proof that every credential remained valid.
Seemant Sehgal, founder and CEO of BreachLock, said: “A ‘don’t ask again’ prompt is a decision to write a credential into a file, and many developers clicking it likely don’t know that file exists.”
Ryan McCurdy, vice president of marketing at Liquibase, said: “What’s concerning is how easily a routine development task can create a security exposure.” He argued that agent configuration, transcripts and execution histories need independent controls.
John Strand, owner of Black Hills Information Security, put the responsibility on development practices: “If you ask an AI agent, ‘Why did you hardcode these API keys and put them in a public GitHub repository?’ it’s going to look right back at us and say, ‘I learned it from you.’”
Engineering teams should add agent-specific files to repository controls, scan Git history, rotate exposed secrets and prohibit credentials in approval commands.
