Claude Code 'Don't Ask Again' leaked secrets across 1,122 public GitHub files
Claude Code's persistent prompt option caused measurable secret leakage in over one thousand public repositories. The exposure stems from agent design that prioritizes workflow continuity over repeated verification. Continuous scanning and vault enforcement are required to contain similar risks in automated coding pipelines.
Apiiro researchers queried GitHub for patterns matching Claude-generated code that stored API keys, passwords, and tokens after the persistent prompt suppression. The scan covered public repositories and isolated files where the agent had bypassed repeated confirmation dialogs. Data showed clusters in Python and JavaScript projects using Anthropic's coding workflows.
GitHub's own secret scanning logs from 2023-2024 recorded similar exposure spikes following Claude 3.5 Sonnet releases. Apiiro cross-referenced commit messages and file metadata to attribute insertions directly to agent output rather than manual edits. This pattern matches prior incidents with Copilot where inline suggestions embedded credentials at rates exceeding 0.4% of scanned repos.
Operational impact includes expanded attack surface for automated secret exfiltration tools and increased false-negative rates in existing secret scanners. Teams relying on agentic workflows must add pre-commit hooks that block persistence flags and enforce separate secret vaults. Without these controls, scale of exposure grows linearly with agent usage volume.
GitHub plans to extend push-protection rules to cover AI-generated secret patterns by Q1 2025. Anthropic has not issued a targeted patch for the dialog state in Claude Code.
Sources (3)
- [1]Primary Source(https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again)
- [2]Supporting Source(https://docs.github.com/en/code-security/secret-scanning)
- [3]Supporting Source(https://www.anthropic.com/news/claude-3-5-sonnet)