“Don’t ask again”: how AI coding agents publish developers’ passwords - Cybersecurity Insiders

AI coding agents like Claude Code offer developers a convenient "don't ask again" option when running shell commands. However, this convenience comes with a significant security risk: the tools store the exact command strings, including passwords and tokens, in project files that often get committed to public repositories. Researchers found that these settings files contain real secrets in over 1% of cases examined on GitHub.

Widespread Exposure

After analyzing 104,185 public copies of these settings files on GitHub, researchers discovered that 1,122 contained real secrets. When including git history, shared settings files, and agent chat transcripts, they found 2,539 distinct secrets across 1,994 repositories and 63 organizations. These exposed credentials included database admin keys, production passwords, and even medical records database owner passwords.

Scanner Blind Spots

The security problem is compounded by limitations in existing secret scanners. When researchers tested popular tools like gitleaks and TruffleHog, they found that these scanners missed approximately one in five secrets. The structural issue is that these scanners look for specific key formats rather than recognizing credentials embedded within command lines, which is how AI agents typically store them.

Beyond GitHub

Most of these sensitive files never reach GitHub at all, remaining on developer laptops where they can be harvested by attackers. Malicious actors have already begun targeting these files, with examples like the Shai-Hulud npm worm running TruffleHog over victims' files. Secrets can also leak through npm packages, Docker images, zip archives, and synced folders without ever touching version control.

Recommended Actions

Developers should immediately untrack these files from repositories, rotate all exposed credentials, and avoid typing secrets directly into commands. Instead, they should reference environment variables. Security teams should treat agent folders as secret-bearing assets, scan them in pre-commit and CI processes, and add these settings files to organization-wide .gitignore templates.

As AI coding agents take on more development work, the memory files they create represent a new vector for secret leaks that requires the same rigorous security practices already applied to .env files and CI logs. This isn't just a bug in one model but a fundamental product behavior that affects multiple AI coding platforms.