Claude Code Shortcut Left Real Passwords on Public GitHub

Read the episode (Narration script)

Good morning and welcome to Cyber World News. One story today is worth acting on: a convenience button in a popular coding agent has been leaving real passwords on the public internet. After that, AI agents poke holes in old encryption, elephants get a recount, your Mac keeps a family tree, and Microsoft closes a research shop. Let's get started.

If you write software with Claude Code, a small file in your project may be holding on to passwords from commands you approved. In more than a thousand public projects, that file is sitting on GitHub where anyone can read it.

Here's how it happens. When Claude Code wants to run a terminal command, it asks permission, and one option is "Yes, and don't ask again." Pick it, and Claude Code saves that exact command as a standing rule in a settings file in your project. If the command had a password typed right in, say to log into a database, the password gets saved too, in plain text.

The security firm Apiiro went looking. Of about 104,000 copies of that file in public GitHub repositories, 1,122 held at least one real secret: among them 379 database passwords, 43 server logins, and 23 Amazon Web Services keys. Add old versions in git history, shared settings and saved agent transcripts, and the count reaches about 2,500 secrets across nearly 2,000 repositories. Popular secret scanners missed 215 of the files, because a plain password doesn't look like an API key. Apiiro didn't test whether the credentials still work, but one company it notified confirmed its exposed key had been live. Of sixteen coding agents compared, Claude Code was the only one confirmed to save the full approved command in a project file by default.

Anthropic's documentation says Claude Code tells git to ignore the file when it first writes it. Apiiro says that protection covers one machine and misses fresh clones, folders that later become repositories, and files already committed. A member of the Claude Code team said on Hacker News that the tool has historically done no secret scrubbing, and that the team is prototyping fixes, including basic secret scanning. A bug report describing this exact behavior was filed in August of last year. A bot closed it in January as "not planned."

The practical advice: search your repositories for that settings file, rotate any password that has ever lived in it, since deleting the file leaves it in the history, and keep secrets in environment variables instead of typing them into commands.

Staying with security, Google DeepMind says its AI agents, steered by human researchers, found two new weaknesses in 1024 bit RSA, an older encryption standard. One shows that if an attacker controls about half of a signed message, the padding meant to stop forgeries adds almost no protection. DeepMind estimates a related attack is about 1,600 times more efficient than the previous best, though that figure is theoretical; the measured result was reproducing a known attack on a solved test key with three and a half times less computing. A second method makes cracking each extra key in a big batch about thirty times cheaper. DeepMind's Pushmeet Kohli says the work took weeks and doesn't affect modern 2048 bit keys. The company's own line: "we cannot treat cryptographic hardness as a fixed assumption."

In Kenya, the group Save the Elephants told Reuters that an aerial survey of the country's largest protected area produced about 200,000 photos, which took nine people nine months to review by hand. AI now does that kind of job in hours, and it showed the human counts had missed about a third of the elephants, half the zebras and giraffes, and three quarters of the oryx. All fifteen environmental groups Reuters spoke with use AI, and all worry about the data centers behind it. Greenpeace uses some too, mostly because its software came with it.

Speaking of keeping count, two security researchers published a teardown late last month of a database Macs have been building in the background since 2022. Apple describes it in one line, as a knowledge graph "representing the device and the user." Inside, the researchers found two small classifiers that score which of your contacts are family, using shared surnames, home addresses, when you message each other and who appears together in your photos, recalculated daily. As far as they can tell, it all stays on the device. Apple hasn't commented. It's a lot of homework about your relatives that nobody assigned.

Microsoft Research's AI Frontiers group, about fifty people who built the agent framework AutoGen, is done. Co founder John Langford wrote that it was folded into Microsoft AI in September, where the philosophy is "scaling, and aggressively not research." He left, and says the other founding leaders did too. His summary: "we did good work and were non consensually reorged away."

One more. After last week's attacks on supermarket freezers, a developer released Coldframe, a decoy that pretends to be one of those refrigeration controllers, accepts the factory default login and records whoever tries it. After its first day online, the only visitors were routine internet scanners.

That about wraps it up for today, friends. Thanks for listening; see you tomorrow!