Claude Code leaks secrets on GitHub
The gist
Security firm Apiiro found 2,539 real secrets in 1,994 public GitHub repositories in files AI coding agents wrote.
Claude Code was the only one of 16 agents saving full commands by default.
How it unfolded
- Aug 11, 2025An earlier bug report said approved commands containing API keys and tokens were being stored word for word in settings.local.json; users have raised the problem in GitHub issues since August 2025.
- Sep 2025The Shai-Hulud npm worm downloaded the secret scanner TruffleHog and ran it on victims' files, flagging 643 of 1,122 files as containing a secret.
- Nov 2, 2026 –3, 2026Apiiro says it reported each affected organization's case to its owner.
Key terms
- repositories
- A storage location for software packages, often managed with version control and metadata.
- npm
- The default package manager and online repository for JavaScript packages, used with the Node.js runtime environment.
Source: Wikipedia