Claude Code's "Don't Ask Again" Leaked Passwords into 1,122 Files on GitHub

⚡ The gist in 5 seconds

• The "Don't Ask Again" option in Claude Code removes repeated confirmations — and the agent writes anything it wants into files, including secrets.
• Apiiro found 1,122 files in public GitHub repositories containing passwords that got there this way.
• There's no reaction from Anthropic on the matter: there's the Apiiro report and a Hacker News discussion — 434 points, 292 comments.

🔍 What happened

Apiiro published an analysis titled "Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files". It's about the confirmation mode in Claude Code: the agent asks for permission before operations, and "Don't Ask Again" removes that prompt for the selected type of action. From then on it runs without stopping — and, according to Apiiro, 1,122 public files on GitHub ended up containing passwords that it wrote there. The figure of 1,122 refers specifically to files, not repositories and not companies. That distinction matters.

The mechanics in general terms — this is context on how coding agents usually work, not details of the report. The agent edits .env, config.json, or a deploy script, sees a variable with a token nearby, and calmly copies it into the new file. Then git add., commit, push — and the secret has gone to a public repository. While the agent asks again, a person has a second to notice. With "Don't Ask Again", that second is gone.

🧠 Our take

Why now: agents have stopped being advisors and gained write access to repositories. The "don't ask again" logic saves dozens of clicks a day — and moves the security decision to the moment when a person is already tired and just wants everything to work. Our assessment: the problem isn't one button, it's that permission dialogs have become too frequent, which is why they get disabled.

What this changes: the cost of a leak lives not in Claude Code but in git history. Deleting the file in the next commit isn't enough — the line remains in the history and is findable via repository search. We believe what matters here isn't "which agent is to blame" but the fact that most teams don't have the habit of rotating keys after an accidental commit.

Who wins: secret scanners and services like GitHub secret scanning get yet another steady source of work. Who loses: those who keep "Don't Ask Again" enabled globally and let the agent into repositories with production keys. In our experience, that's exactly how it happens at small teams without a dedicated security person.

⚠️ What we don't know

The report doesn't include the number of repositories or owners, no data on whether the keys are live, and no breakdown of how many of the 1,122 files are test placeholders like example_password. There's no reaction from Anthropic, no CVE, no independent verification of the methodology. The source is a single one — a security company for whom the topic is also interesting as a reason to publish. 1,122 files does not equal 1,122 breaches: some are probably harmless, but only someone with the actual keys can verify that.

Prediction: within a quarter, at least one major coding agent will add a secrets warning at the moment a file is written, not just at the commit stage.

Disclaimer: not officially confirmed; a single source — the Apiiro report.

Source: Apiiro