Security firm Apiiro has exposed a significant supply chain risk in the current wave of agentic coding tools, identifying 2,539 real secrets scattered across 1,994 public GitHub repositories. The breach vector isn't a sophisticated exploit but a convenience feature: the ".claude/settings.local.json" file. This local configuration, created when developers opt for the "don't ask again" permission mode in Anthropic's Claude Code, inadvertently stores sensitive credentials that users then push to public repos.

The Hidden Vector

The investigation analyzed 104,185 public copies of the ".claude/settings.local.json" file on GitHub. Of those, 1,122 contained at least one valid secret, affecting 63 distinct organizations. These were not dummy strings or test fixtures; Apiiro confirmed the presence of live cloud keys, API tokens, and internal credentials. One organization confirmed that a leaked key remained active after discovery, highlighting the immediate operational risk posed by these silent exposures.

Agentic Residue and Attack Surface

This incident marks a shift from traditional hardcoded key issues to what can be termed agentic residue. As coding assistants evolve from simple autocomplete engines into autonomous agents that execute tasks and manage permissions, they write state to disk. Unlike a developer manually pasting a token into a script, the agent creates permission memory files automatically. Traditional secret scanners often miss these hidden directories, creating a blind spot where sensitive data persists in machine-specific folders that are rarely reviewed during code audits.

Mitigation and Vendor Responsibility

For engineering teams, the remediation path is clear but urgent: review ignore rules to exclude ".claude/settings.local.json" from commits and extend secret scanning coverage into hidden directories. Crucially, deletion from a repository does not guarantee privacy, as forks, mirrors, and search indexes may have already copied the exposed credentials. Vendors like Anthropic now face growing pressure to reevaluate default storage choices. The next battleground for coding agents isn't just model performance, but where and how the agent writes its memory.

Key Takeaways

  • 2,539 real secrets were found in 1,994 public GitHub repos, primarily within ".claude/settings.local.json" files.
  • 1,122 out of 104,185 scanned config files contained valid credentials, affecting 63 organizations.
  • The leak source is the "don't ask again" permission feature, which writes state to disk for agent persistence.
  • Traditional secret scanners often fail to detect risks in hidden local paths and machine-specific folders.
  • Developers must rotate any exposed keys immediately, as deletion does not prevent prior scraping or forking.

The Bottom Line

Convenience is the new attack surface. Anthropic must treat agent memory files as security-critical artifacts, not just local cache, or risk turning developer productivity into a data leak.