Clicking “Don't Ask Again” Again Leads to Sensitive Data Leaks Through AI Coding Assistant

According to reports on the 9th from The Hacker News and other outlets, application security company Apiiro disclosed a sensitive data leak issue related to Anthropic’s AI coding agent Claude Code.

The issue concerns cases in which sensitive data stored in GitHub public repositories was found to have leaked through an AI coding tool’s skip-approval feature. It appears that a convenience feature introduced for developers created a security blind spot.

The investigation found 2,539 pieces of sensitive data across 1,994 public GitHub repositories. The sensitive data included DB passwords, cloud keys, and API tokens.

In one example, a cloud key leaked on GitHub was found to still be in active use within an organization.

Under conditions where external DB and API integrations were involved in Claude Code, when a user requested a DB check or an API call, the generated command included a secret key from a configuration file. Then, if the user selected “Yes, and don't ask again” in the confirmation prompt before execution, the command and secret key were saved to a configuration file in the project folder.

This configuration file was supposed to be a local file that existed only on a developer's PC. However, the project folder had no “Do not make public” label, and the file had been temporarily hidden only inside a personal computer, revealing a structural flaw that proved problematic.

When code was moved to another computer or a collaboration situation arose with colleagues, Git treated that file as an ordinary source code file. As a result, it ended up being made public on the internet.

Apiiro said the leak was linked not only to simple developer mistakes but also to the way AI operates. Apiiro said it confirmed signs that AI contributed to the leak in addition to developer error. In 539 repositories under review, Claude Code was found to have uploaded configuration files containing sensitive data to GitHub while saving work. Claude Code was designed to block GitHub uploads of critical secret files, but files generated by Claude Code were excluded from the upload-block list.

Apiiro also presented cases in which detection tools missed plaintext passwords in configuration files. A secret scanner for source code checks failed to detect the issue. Apiiro examined more than 104,000 files with two external solutions, but neither solution detected sensitive data in 215 files. The reason for the missed detection was identified as the scanner recognizing plain-text passwords following “PGPASSWORD=” as normal code.

Apiiro urged users to check whether Claude Code configuration files have been uploaded within GitHub. It also advised registering the files on the exclusion list to prevent recurrence. In addition, it explained that simply deleting the files does not erase information from past history. Apiiro emphasized that any password or authentication key exposed even once should be reissued immediately.

Source: IT DAILY · Kim Ho-jun
Original: https://www.itdaily.kr/news/articleView.html?idxno=242790

References

• https://www.itdaily.kr/news/articleView.html?idxno=242790