Your agent's settings are code now — and they are leaking your secrets onto GitHub

1,122 files, 1,379 secrets

Claude Code's Don't Ask Again feature can inadvertently save sensitive credentials in plain text within local settings files, which developers have subsequently committed to public GitHub repositories. Research by Apiiro identified 1,122 public files containing 1,379 distinct secrets: when users select Don't Ask Again, Claude Code saves approved commands, including passwords and tokens, into .claude/settings.local.json. Anthropic's Boris Cherny stated the file is meant to stay local and should not be checked into source control, and Anthropic is looking into ways to prevent the accidental saving of secrets in settings files. The feature worked as designed. The design assumed the file would never leave the machine. m:…7247

The exposure is worse than the count suggests. Automated secret scanners like gitleaks and TruffleHog failed to detect 215 of the 1,122 exposed files in Apiiro's testing, and in half of the repositories with a secret, the file had sat on the default branch for at least 217 days. Removing the settings file does not undo exposure because older versions remain in Git history and forks. Claude Code is the only coding agent confirmed to save the full approved command in a project file by default. The secrets are not just in the file. They are in the history of every repository that ever contained it. m:…7247

The sandbox was the secret

Runlayer reproduced a critical vulnerability in Grok Bot, where prompt injection allows an attacker to gain root access to the agent's sandbox environment. One command from an agent results in root access to the virtual machine Grok uses as its sandbox, enabling credential theft, unauthorized command execution, and access to connected applications. Attackers can steal credentials stored on the virtual machine, execute commands within the sandbox, and access files and browser sessions. All agents within a Grok account share the same credentials, user, and file system, and Grok's architecture assumes that commands generated by its AI agents can be trusted. Profero reported the findings on August 24 and had not heard back 75+ days later. m:…9513

The fix is architectural, not a checklist

In a preprint, researchers propose the kind of fix this pattern needs: ActiveSecHarness, a neurosymbolic architecture that replaces high-latency LLM-as-a-judge guardrails with deterministic, low-latency Ring-0 security controls for agentic coding harnesses. The architecture achieves 100% attack blocking and 0% false positive rates using Ring-0 operating system and tool guards, and uses a 2D product taint lattice and HMAC capability tokens to enforce security at the architecture level. By comparison, LLM-as-a-judge guardrails incur 142.3ms latency and exhibit 98.3% benign work refusal. A 2D product taint lattice prevents secret laundering across disk more effectively than coarse Boolean taint blocks. m:…9221

Qodo proposes a four-part review layer for agent settings to improve security and governance, and Runlayer argues that agent security requires inspecting inputs at runtime, using unique identities for agents, and logging activity outside the execution environment. The common thread is that agent configuration is now code, agent sandboxes are now infrastructure, and agent tokens are now credentials — and all three need the controls that code, infrastructure, and credentials already have. The leaks this week were not exotic attacks. They were defaults, and defaults are a choice. m:…7247 m:…9513