A security flaw in Claude Code, Anthropic's AI-powered coding assistant, has caused thousands of sensitive secrets to be exposed on GitHub. Researchers discovered that a setting tied to a "Do not ask again" prompt led the tool to save configuration files containing passwords, API keys, and private credentials into project folders. When developers then pushed their code to public repositories, those secrets went with them, creating a windfall for malicious scanners and potential attackers.
The problem highlights how AI tools that generate or manage code can accidentally introduce serious vulnerabilities. Many users assume that a polished product from a well-known AI lab will handle data safely by default. In this case, the convenience of skipping repetitive prompts appears to have overridden basic security hygiene, leaving a trail of exposed credentials across the open web without users realizing what happened.
For individuals and businesses, the impact is immediate and concrete. Leaked API keys can allow attackers to access cloud services, databases, and third-party platforms on behalf of the victim, racking up charges or stealing data. Replacing those keys, revoking permissions, and auditing access logs takes significant time and money. Some of the exposed secrets may have been sitting in public repos for days or weeks before anyone noticed, meaning the window for abuse has already been open.
Anthropic now faces pressure to patch the behavior and alert every affected user. Developers who use Claude Code should immediately review their recent commits and remove any configuration files they did not intentionally create. The incident also serves as a broader warning for the entire AI industry. As these assistants gain deeper access to files, terminals, and workflows, even small design choices can spiral into large-scale security incidents. Companies building coding agents will need to treat secret leakage as a top priority and build stronger safeguards directly into their tools before more users are put at risk.