A simple convenience feature in Anthropic’s Claude Code has been saving sensitive credentials in places developers never intended to share them. Security researchers discovered thousands of exposed passwords, API keys, database credentials, and server logins in publicly accessible GitHub repositories. The problem begins with an ordinary permission request: a developer approves an AI-generated command and tells the assistant it doesn’t need to ask again.
The command executes as authorized. But Claude Code can also save the complete command, including any embedded credentials, as a persistent permission rule. If that settings file later enters a public repository, the credentials become accessible to others.
Research published by Apiiro on November 5, 2026, and subsequently reported by Ars Technica, shows how a routine approval mechanism can introduce a significant security vulnerability. It also exposes a broader architectural problem facing autonomous AI: the difference between authorizing an action and controlling the consequences of that authorization.
How a Simple Approval Became a Security Exposure
Claude Code allows developers to approve shell commands that the assistant proposes to execute. To reduce interruptions, developers can select an option that permits the same command to run again without further approval.
This is useful when an AI coding assistant needs to perform repetitive operations. The problem arises when the approved command contains sensitive information.
Consider an assistant connecting to a database to troubleshoot an application. The command might include a database password or authentication token. When the developer approves it, Claude Code can preserve the entire command inside a local configuration file called .claude/settings.local.json.
That file is intended to remain on the developer’s computer. Claude Code normally adds it to the machine’s Git exclusion configuration, reducing the likelihood that it will be committed to a public repository.
However, the protection does not necessarily follow the project to another computer, a newly initialized repository, or a repository where the file was already tracked. Under those conditions, the file can be committed alongside ordinary source code.
The researchers also found instances where Claude Code had participated in commits that modified the affected settings file.
The result is a persistent record of commands containing credentials that were originally intended only for local execution.
The Scale Is Larger Than Initially Reported
Apiiro examined 104,185 publicly accessible copies of Claude Code’s local settings file. It identified 1,122 files containing 1,379 distinct secrets. When researchers expanded their analysis to historical commits, shared configuration files, and agent transcripts, the total reached 2,539 secrets across 1,994 repositories.
The findings included database passwords, cloud credentials, API tokens, and SSH logins. Researchers identified 63 affected organizations. Apiiro did not attempt to use the credentials it discovered, so its research did not establish how many remained exploitable.
A separate investigation published November 9 by GitGuardian examined a longer historical period using continuous monitoring. It identified 31,088 distinct secrets in public copies of the local settings file, including 5,343 that its automated checks found valid when detected.
The difference between these findings reflects their methodologies. Apiiro concentrated on exposed files and selected historical artifacts, while GitGuardian analyzed credentials observed across public commits over time.
GitGuardian also found credentials embedded in publicly distributed Docker images, demonstrating that sensitive information can spread through build and deployment processes even when repository protections are in place.
These results establish a problem extending beyond a single configuration file. AI development environments create operational records that can contain sensitive data, and those records can move through software distribution systems without receiving the same protections as dedicated credential stores.
The Permission Was Valid. Its Scope Was Incomplete.
The most significant lesson concerns how permission is represented.
When a developer approves a command, the intended authorization is usually narrow: execute this operation within the current development environment. The developer is not intentionally authorizing the system to preserve reusable credentials in a distributable file.
Nevertheless, the approval mechanism may treat the complete command as a reusable permission rule.
That creates two distinct security concerns. The first is the handling of sensitive data. Credentials should not be written into persistent configuration records when safer alternatives, such as protected secret stores or environment-variable references, are available.
The second concerns the durability and scope of authority. A command approved for a particular purpose may be permitted again under conditions the developer has not independently evaluated.
This is especially important for autonomous AI agents that can perform numerous operations over extended periods. Permission systems must account for what is authorized, how long that authorization remains valid, which resources it covers, and what information can be retained as a consequence.
The research also revealed limitations in conventional detection tools. Apiiro found that 215 of the 1,122 affected local settings files were missed by both Gitleaks and TruffleHog during its testing.
Credentials embedded inside otherwise ordinary commands can evade scanners designed primarily to recognize familiar secret formats.
Where Deterministic Behavioral Governance Fits
VERN OS is designed to provide independent control over how AI agents behave and execute authorized operations.
Its Behavioral Control Modules (BCMs) allow organizations to define requirements governing tool usage, authorization, execution limits, escalation, and agent behavior. Unlike instructions that depend entirely on a language model’s interpretation, these controls can be enforced through integrated runtime mechanisms.
Consider an AI coding agent operating under a policy that restricts access to sensitive credentials or requires additional authorization for specified command classes. A properly integrated BCM could prevent prohibited tool operations from proceeding even if the underlying agent considered them useful.
Organizations could also establish policies limiting which commands may execute automatically or requiring renewed authorization under defined circumstances.
These capabilities address the governance of agent behavior and tool execution. Preventing the specific Claude Code vulnerability would additionally require controls over how permissions are persisted and how sensitive information enters configuration files.
Dedicated secrets-management systems, repository protections, secure credential handling, and pre-execution scanning remain essential. GitGuardian, for example, describes hooks that inspect agent tool calls before execution to identify exposed secrets.
VERN’s role is complementary: keeping agent operations within explicitly authorized behavioral boundaries while other security systems protect credentials and software infrastructure.
Enterprise AI Needs More Precise Authorization
The Claude Code findings illustrate how problems can arise even when an AI system follows its intended workflow.
The assistant requested permission. The developer granted it. The tool executed the command and stored a reusable rule according to its implementation.
The unintended exposure occurred because the system did not adequately separate temporary operational authority from persistent information storage and subsequent distribution.
For enterprises, this has implications beyond software development. AI agents increasingly interact with financial systems, customer records, internal applications, and production infrastructure. Each integration introduces opportunities for permissions and sensitive information to persist beyond their original purpose.
Organizations need clear authorization boundaries, appropriately scoped credentials, data-retention controls, and reliable enforcement across the full operational workflow.
The research provides another reason to treat AI governance as an engineering discipline rather than a collection of instructions about desirable behavior.
A reliable AI system must respect the limits of an authorization throughout its lifecycle, including what the system executes, records, retains, and exposes.
Sources
- Ars Technica, November 9, 2026: https://arstechnica.com/ai/2026/11/claude-code-settings-files-expose-thousands-of-secrets-on-github/
- Apiiro, November 5, 2026: https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again
- GitGuardian, November 9, 2026: https://blog.gitguardian.com/claude-code-settings-local-json-secrets-docker-hub/
- Anthropic, Claude Code settings documentation: https://code.claude.com/docs/en/settings
- VERN OS agentic controls: https://vernai.com/agentic-control/
