Claude Code Auto-Approve Leaks Thousands of Passwords on GitHub 2026

Claude Code's auto-approve feature has been found to leak thousands of passwords on GitHub, exposing sensitive credentials like database passwords, SSH logins, private keys, and API tokens. The issue, discovered by security researchers at Apiiro, highlights a dangerous side effect of AI coding assistants that prioritize convenience over security.

What Happened: The 'Yes, Don't Ask Again' Trap

Claude Code, like many AI coding tools, includes a 'Yes, and don't ask again' option to reduce repetitive prompts. When a user approves a command with this setting, the command—including any embedded secrets—is saved verbatim in a configuration file. That file can later be inadvertently included in code generated by the AI and pushed to public repositories.

According to Apiiro, this led to the exposure of database passwords, SSH server credentials, private keys, GitHub tokens, and AWS keys. The leak occurs because the AI assistant treats the approved command as a template, potentially replicating it in future outputs without redacting sensitive information.

Why This Matters: The Real-World Impact

Leaked credentials can give attackers direct access to critical systems. A single exposed API key or password can compromise an entire cloud environment, leading to data breaches, financial loss, and reputational damage.

Developers often trust AI assistants to handle code safely, but this incident shows that automation without safeguards can introduce severe vulnerabilities. The leak is not limited to one repository; it affects any project where Claude Code was used with auto-approve enabled and secrets were present in commands.

Key Takeaways

• Auto-approve features can store sensitive data in plain text.
• AI-generated code may inadvertently include secrets from saved commands.
• Public repositories are scanned by attackers for exposed credentials.
• Developers must audit AI tool configurations and use secret management.
• Regularly rotate keys and passwords to mitigate potential leaks.

How the Leak Happens: A Technical Breakdown

When a user checks 'don't ask again,' Claude Code saves the command in a local file, often within the project directory. If that file is committed to version control—intentionally or accidentally—and pushed to GitHub, the secrets become public.

The AI may also reference this file when generating new code, effectively copying the secret into other parts of the project. Apiiro's researchers found that even after the initial command was executed, the saved data persisted and was reused in subsequent AI interactions. The background to this story is set out in AI Coding Tools Like Claude Code Turn Developers Into Enter-Key Pushers. A related thread runs through Claude Code Leaked Your Email to Websites: What You Need to Know. Earlier coverage in Claude Code: AI Programming Tool for Your Terminal Explained shows how the argument developed.

Who Is Affected and What to Watch Next

Any developer or organization using Claude Code with the auto-approve feature is at risk, especially if they handle secrets in commands. The leak is not limited to individual users; enterprises with multiple teams could face widespread exposure. A closer look at the same subject appears in Claude Fable 5.2 Designs Real-World Devices Beyond Vibe Coding. Anyone following the wider picture can start with Germany Approves Spy Agency Reform in Security Revolution. The same theme surfaces in Ai Video: latest articles, which takes a different angle.

Moving forward, watch for updates from Anthropic (the maker of Claude Code) addressing this issue. Security researchers recommend disabling auto-approve for commands containing sensitive data and using environment variables or secret managers instead of hardcoding credentials. Context on how this played out before sits in AI Coding Tools Flood App Stores But Users Ignore Them.

FAQ