Claude Code's 'Don't Ask Again' exposes passwords in 1,122 public GitHub files
claude
| Source: HN | Original article
Claude Code's "Don't Ask Again" feature unintentionally exposed passwords in more than 1,100 public GitHub files.
Claude Code’s “Don’t Ask Again” feature has unintentionally exposed passwords in more than a thousand public GitHub repositories, a security breach that affects 1,122 files identified so far. The AI‑driven coding assistant, part of the Claude family of tools, was designed to let users suppress repeated prompts, but the implementation appears to have logged or echoed credential strings when the option was activated. Researchers who scanned public repositories flagged the exposed secrets, prompting immediate alerts to the affected developers and to Anthropic, the company behind Claude.
The incident matters because it highlights a new attack surface for AI‑assisted development tools. Passwords embedded in code are already a known risk, but an AI feature that can surface them at scale amplifies the threat, potentially giving malicious actors ready‑made credentials for cloud services, databases, or APIs. The breach also raises questions about how AI models handle sensitive data during interaction, and it could erode trust in code‑generation assistants that many teams rely on for productivity gains.
What to watch next is Anthropic’s response: a patch to the “Don’t Ask Again” logic, a public disclosure of the remediation steps, and any compensation or guidance offered to developers whose secrets were leaked. GitHub may also tighten its secret‑scanning alerts in light of AI‑generated exposures. The episode adds to growing scrutiny of AI tools in software supply chains, suggesting regulators and enterprises may soon demand stricter safeguards and transparency around how AI models process and retain confidential information.
Sources
Back to AIPULSEN