Claude Code's "Don't Ask Again" exposed passwords in 1,122 public GitHub files
shmulc · hn · 2026-11-08
Apiiro research finds that Claude Code's "Don't Ask Again" option lets coding agents bypass confirmations, causing API keys and passwords to be written into code and pushed to GitHub. 1,122 public GitHub files have already been found containing secrets leaked through this workflow, highlighting a new attack surface: automation convenience directly trades against secrets-leak risk.
More from coding & agent
- Gemini /teamwork agents caught live: four parallel task logs all running that second — RyanSpunk · 2026-11-13
- Codex CLI 0.168.0 adds model provider picker, side-by-side TUI workspace and animated GIF generation — github-actions[bot] · 2026-11-13
- Free MCP server lets Claude read Altium, Allegro, KiCad and Gerber PCB files directly — woodisruff · 2026-11-13
- a16z Partner Clones Open-Source Game with Fable 5.2 Agent, Which Finds Its Own Horse Animation Asset — FinanceYF5 · 2026-11-13
- OpenAI team shares how it runs and governs fleets of persistent agents internally — romainhuet · 2026-11-13
- Perplexity's Decider scanned 1B tokens across 7,000 agent sessions, found 14 security fixes — denisyarats · 2026-11-13