What we know
Claude Code, an AI coding assistant developed by Anthropic, is unintentionally exposing sensitive information such as passwords and API keys in public GitHub repositories. This exposure is linked to a misconfigured "Do not ask again" prompt within the tool. As a result, thousands of secrets have been committed publicly, creating a significant security risk for developers using Claude Code.
Why it matters
This issue highlights a serious vulnerability in an AI tool designed to assist developers, potentially putting sensitive credentials at risk. Exposed passwords and API keys can lead to unauthorized access, data breaches, and other security incidents. The widespread nature of the problem suggests that many users may be affected, raising concerns about the safety of AI-assisted coding tools and the need for better safeguards.
What is still unknown
No independent tests have verified the extent or accuracy of the exposure. Details about which programming languages or environments are most affected have not been disclosed. There is also no information on whether Anthropic has issued patches or updates to fix the problem or on the timeline for any such fixes.