What happened
Apiiro’s November 5, 2026 research describes how Claude Code can save an approved shell command as a permission rule in .claude/settings.local.json. When a command includes a database password, API token or other secret, the saved rule can contain that value. Choosing “Yes, and don’t ask again” allows the command and records it so Claude Code will not ask again for that command. Apiiro says it reproduced the behavior with Opus 5.5 and Fable 5.1, and characterizes it as Claude Code behavior rather than model behavior.
Claude Code adds the file to the developer’s global Git ignore list when it creates it inside a repository. Apiiro says that protection does not travel with the project in its own .gitignore; it can fail when a folder becomes a repository later, when the file is already tracked, or when a copy is committed manually. The report says Claude Code recognizes tracked copies, but does not alert the user before appending a later approval. In 539 of the 1,105 repositories with a real secret that Apiiro traced, a Claude-coauthored commit changed the file.
Using read-only GitHub code and commit searches from November 1 to 3, Apiiro counted 104,185 public .claude/settings.local.json files across 103,617 repositories. It identified 1,122 files containing a real secret, including 1,379 distinct secrets: 636 provider keys and 743 passwords or tokens associated with public hosts. The company also found secrets in file history, shared .claude/settings.json files and agent transcripts, memory files, handoff notes and Copilot settings. Across those sources, it counted 2,539 distinct secrets in 1,994 repositories. It reports 63 organizations with a real secret in a public allowlist and 211 forks of 74 repositories carrying the same secrets.
The report tested gitleaks and TruffleHog against all 104,185 local settings files. Of the 1,122 files with a real secret, gitleaks flagged 564 and TruffleHog flagged 643; 215 were flagged by neither. Apiiro attributes much of the gap to passwords embedded in otherwise ordinary commands, such as PGPASSWORD=, sshpass -p or a bearer header, rather than recognizable provider-key formats. It also says it found secrets in 298 of 76,011 shared settings files and in 120 of 2,523 agent transcript files checked.
Apiiro recommends checking current files and Git history, rotating credentials found there, adding agent directories to repository and CI scanning, and avoiding literal secrets in commands. It suggests using environment variables and approving command patterns rather than commands containing credential values. On November 7, Anthropic’s Head of Claude Code Boris Cherny said the team was looking into prevention, including prototyping basic secret scanning and Auto Mode changes; he acknowledged that sensitive commands could present a similar issue in Auto Mode.
What the archive adds
New Runtime’s earlier coverage described Claude Code’s Auto Mode as a compromise between safety and approval friction, with users potentially responding to frequent prompts by approving too broadly. This is a new security finding that adds a concrete credential-persistence mechanism and public-repository counts to that concern.
Trend signal
This supports agent security moves to runtime boundaries: permission prompts alone do not contain risk when approval records can persist secrets in project files. The finding points to the need for controls over what the agent records and what can enter version control, alongside user approval.
Why now
Apiiro says the affected files remain present on repository default branches; in the median repository with a secret, the file had first been committed 217 days earlier. Following publication, Anthropic’s Claude Code lead said the team would prototype possible mitigations, so the report is both a disclosure of existing exposure and a prompt for product changes.
Connections to other events
New Runtime’s earlier coverage of Claude Code Auto Mode described approval fatigue and the risk that users may click through repeated permission prompts. Apiiro’s report shows a consequence distinct from overbroad execution: an approved command can also become durable project data containing a credential.
Why it matters
A coding agent’s working directory is not just scratch space. Permission rules, transcripts, memory and handoff files can become software artifacts that move through commits, forks, package builds and team sync. Treating only .env and conventional credential files as sensitive leaves a blind spot, particularly because passwords embedded in command lines may evade scanners tuned to known key formats.
For teams, the immediate work is operational rather than model-specific: inspect agent-created files on developer machines and in repositories, scan history, and rotate any exposed credential before attempting cleanup. Prevention should reduce both secret entry into commands and persistence of sensitive command strings. Anthropic’s proposed prototypes may help, but the report does not establish that a product change has shipped.
What happens next
- Claude Code will ship at least one new safeguard for secrets in approval records (6 months, 65%). Watch for: release notes describing secret scanning or permission-rule handling.
- More teams will add agent configuration and transcript paths to repository secret checks (6 months, 60%). Watch for: CI and pre-commit policies explicitly covering
.claude/,.cursor/and agent transcripts.
Limits and uncertainty
Apiiro says it did not use or test any credential, and “real secret” means a value matching a provider format or paired with a public host, not a credential confirmed to work. Its classification involved rule-based filtering and an independent LLM review for most values; memory files, handoff notes and Copilot settings used rules alone. GitHub code search has a 1,000-result cap per query, which Apiiro says it addressed by splitting searches into size ranges. The findings establish exposure indicators, not confirmed exploitation, and do not measure how many affected credentials remain valid.
Skill to build now
This week, add agent-generated files to a repository audit: search for .claude/settings.local.json, shared agent settings, transcripts and memory files, then inspect Git history as well as the working tree. Scan command text for password-bearing patterns such as PGPASSWORD=, sshpass -p and bearer headers, not only provider-key prefixes. If a credential appears, rotate it first; then remove the file from tracking and prevent recurrence with repository-level ignore and scanning rules.
Reader takeaway
A “don’t ask again” approval can turn a one-time command into a persistent record, and that record may carry the secret itself. Treat coding-agent settings and transcripts as credential-bearing data, scan them and their history, and rotate any exposed credentials rather than relying on deleting the current file.
Open question
Will Anthropic’s planned prototypes prevent secrets from being recorded without breaking legitimate command approvals?