Claude Code 'Don't Ask Again' Settings File Leaks 1,122 Secrets: Risks and Response

While AI coding assistants boost development efficiency, they also introduce new security blind spots. According to a YouTube security channel, researchers found that Claude Code's "Don't Ask Again" configuration files have leaked extensively on GitHub, with at least 1,122 of them containing plaintext secrets. The incident reveals potential risks in how AI agent tools design permission memory and file management.

According to research data cited by the channel, a researcher known as "A pyro" scanned GitHub and found 104,185 .claude-settings.local.json files across 103,617 repositories, of which 1,122 were flagged as containing at least one secret. These secrets include database passwords, SSH login credentials, API tokens, and AWS keys.

Root Cause: A Convenience Design That Buries Risk

Claude Code asks the user for confirmation before executing most shell commands. When the user clicks "Yes, don't ask again," that command is saved verbatim in .claude-settings.local.json. The problem: if the user typed a secret directly into the command, that sensitive information is written to the file in plaintext.

Analysis suggests this behavior is part of the product design. The client adds the file to the user's global Git Excludes list, but not to the project's own .gitignore. That means when developers commit project files, the configuration file can still be accidentally included in version control.

The researcher says the behavior was reproduced on Opus 5.5 and Fable 5.1. Because the file may exist in repository history, fork copies, and packaged artifacts, a single approved instruction can cause persistent credential leakage.

Global Git Excludes vs. Project .gitignore

Git's ignore mechanism has two levels: the project-level .gitignore file ships with the repository and applies to all collaborators on that repo; the global excludes list (typically at ~/.config/git/ignore or specified by core.excludesFile) applies only to the current user's machine and is never committed to any repository. Claude Code writing the config file to global excludes only prevents that user from accidentally committing on their own machine; it cannot constrain anyone else who clones the repo, nor prevent git add -f, packaging tools, or CI scripts from including the file in artifacts. This is the structural reason the leak is far larger than expected: developers subjectively believed "it's already ignored," but the protection actually covered only their local machine.

Leak Scale and Scope of Impact

According to the channel's tally, a total of 1,379 distinct secrets were found across the flagged files. Of these, 379 were database passwords; the rest included 43 SSH login credentials, 42 repository tokens, and 23 AWS keys. Many files had remained on default branches for months.

Appiero's tracing shows the affected files are linked to 63 organizations. Packaged artifacts may expose downstream systems even if the original repository has been deleted. This means the risk is not limited to the developer's own machine but may also affect downstream users of related packages or images.

The channel rates the editorial assessment of this incident as "High," based on: confirmed plaintext secrets that can unlock databases and cloud accounts; the continued persistence of files on default branches and fork copies; and active exploitation activity on related attack vectors.

Why Forks and Packaged Artifacts Amplify Risk

Forking a repository on GitHub copies everything, including commit history. Deleting files from the original repo afterward does not synchronously purge existing forks; likewise, blob objects in historical commits remain recoverable via git log or dangling objects even after removal from the default branch. Packaged artifacts (npm tarballs, Docker image layers, build caches) carry files from the source repository into the downstream dependency chain, so downstream users inherit credentials without any knowledge. Therefore, "deleting a file" must cover three layers: the current branch, the full commit history (requires rewriting with tools like git filter-repo), and published artifacts—otherwise the exposure surface remains.

Interwoven Timeline with Other Vulnerabilities

The incident did not happen in isolation. According to the timeline compiled by the same source, the researcher reported the saved approved-command issue on August 11, 2025. Around the same time, WordPress released version 7.1.4 to fix CVE-2026-11997, and probing activity was observed shortly afterward. OpenSSH's CVE-2026-123-158 was patched in OpenSSH 10.6 P2, but exploitation attempts appeared within hours.

On the OpenSSH side, a honeypot recorded confirmed root access. WordPress's fix randomized the temporary upgrade folder name, but in some scenarios the updater still unpacks existing site code, leaving a brief exposure window. Microsoft Paint's fix was delivered via the Microsoft Store as build 11.2609.401.0 rather than through Windows Update.

The channel also notes that Apiro did not test the validity of every secret one by one, but one notified company confirmed its key was active. Forever Security demonstrated a dispatch-based attack in lab tests but did not report in-the-wild abuse.

A Broader Trend: AI Accelerates Discovery—and Risk

This incident reflects a larger industry picture. According to the channel, OpenAI said GPT-6 Cyber discovered 948 local Linux privilege escalation vulnerabilities and 81 high-severity Firefox flaws. Chainguard's Athena project has reported over 40,000 findings since June and warns that the disclosure pipeline is overwhelmed.

This means defenders face more findings and shorter response windows. While AI tools and automated agents accelerate vulnerability discovery, they also make secrets and code execution paths appear in more unexpected places.

What Disclosure Pipeline Overload Means

Vulnerability disclosure relies on a relatively fragile chain: finder → vendor Product Security Incident Response Team (PSIRT) → patch development → coordinated release (CNA/CVE numbering) → downstream distribution. When AI tools raise the volume of findings by one to two orders of magnitude, the bottleneck shifts from "discovery" to "validation, triage, and patching." Maintainers face a flood of duplicate reports and low-quality submissions, and genuinely severe issues can get drowned out. This is why projects like Chainguard Athena emphasize that "the disclosure pipeline is overwhelmed": if improved discovery capability is not matched by improved triage automation and patching capacity, actual risk reduction is greatly diminished. For users, this means shifting from "waiting for official advisories" to "proactive self-checks based on SBOMs and asset inventories."

Practical Response Steps

According to the channel's recommendations, developers and administrators can take the following measures:

Rotate secrets immediately. For any .claude-settings.local.json file discovered, rotate all passwords, tokens, and keys it ever held before cleaning up.

Audit and remove files. Purge the file from repository history, fork copies, and packaged artifacts, and check npm packages, Docker images, and synced folders.

Harden the update process. Block web access to wp-content/upgrade during updates, or update offline and verify package types.

Patch and monitor. Install OpenSSH 10.6p2 or your distro package, restart sshd, and check logs for accepted password records on accounts that should be key-only.

Reduce agent permissions. Disable or revoke dispatch, and minimize agent privileges. If a host cannot be fully verified, assume compromise and initiate incident response.

Key Takeaways

Coding assistants and cross-device agents are changing where secrets and execution paths appear. Rotate secrets first, purge history, then patch and harden updaters and reduce agent privileges. Model-driven discovery is amplifying both signal and risk at the same time; for development teams, including AI tool configuration files in security audits is now urgent.

All information sources point to links in the YouTube channel's description, including Apiro and Hacker News coverage of Claude Code, Forever Security's analysis of dispatch, Providian's explanation of the OpenSSH vulnerability, Umut Bayram's tracking of WordPress CVE-2026-11997, The Hacker News' reporting on Microsoft Paint, coverage of OpenAI GPT-6 Cyber, and related Chainguard Athena content.