A security flaw in Anthropic's Claude Code feature, 'Don't Ask Again,' has inadvertently exposed sensitive credentials across 1,122 public GitHub repositories. The setting, designed to bypass repeated permission prompts, instead stored API keys and passwords in plaintext within configuration files. Researchers discovered that developers who enabled the feature left authentication tokens accessible to anyone browsing the codebase.
The issue highlights the risks of convenience-driven security shortcuts in AI-assisted development tools. Anthropic has acknowledged the vulnerability and is rolling out a fix to prevent future leaks. Experts urge developers to audit their repositories and rotate any exposed credentials immediately.
Source: Hacker News · Summarized by HeadlinesBriefing