Anthropic's Claude Code asks by default before running most shell commands. When the user picks "Yes, and don't ask again", an allow rule is saved in .claude/settings.local.json inside the project. Sometimes the rule is a general pattern, and sometimes it is the exact command, in which case any password or token typed into it is saved in plain text. According to The Hacker News, the researchers reproduced the behavior with the latest models as well.
Apiiro found 104,185 copies of the file on public GitHub, and about 1.1% of them, 1,122 copies, hold at least one secret. In total, counting older versions in git history, the shared settings file and saved chat logs, it counted 2,539 secrets across 1,994 repositories. More than a third open a database directly, including 379 database passwords, 43 SSH logins, 42 GitHub, GitLab and npm tokens and 23 AWS keys. The researchers did not test whether the secrets still work, but one company they notified confirmed its key had been live.
Claude Code adds the file to the global git excludes on the user's computer, but not to the project's .gitignore, so the protection does not travel with the project and does not cover a file already committed. In 539 of 1,105 repositories examined, the change to the file came in a commit that lists Claude as a co-author. Of 16 coding agents the researchers compared, Claude Code is the only one confirmed to save the full approved command in a project file by default.
The advice: search your organization for .claude/settings.local.json and .claude/settings.json, including git history and forks; rotate every password, token and key they have held first, and only then clean up; stop tracking the local file and add it to the repository's .gitignore; and delete any rule containing a secret on your own computer. The report did not include a response from Anthropic.