A convenience feature became a credential leak
The headline is uncomfortable because the mechanism is so ordinary: a developer approves a command, chooses “Yes, and don’t ask again,” and Claude Code stores the approved rule for later. Apiiro’s November 5 research says that if the approved command contains a password, API token, cloud key or database connection string, the exact command can be written into .claude/settings.local.json in the project folder . That is not an exotic exploit; it is a workflow artifact becoming a secret store.
Apiiro said it found 104,185 public copies of .claude/settings.local.json in 103,617 GitHub repositories, with 1,122 files containing at least one real secret . The Hacker News, reporting on the same findings on November 7, said those public files included 1,379 distinct credentials, among them 379 database passwords, 43 SSH logins, 42 GitHub, GitLab and npm tokens, and 23 AWS keys . Apiiro’s wider count, including git history, shared settings, and agent transcripts, reached 2,539 real secrets across 1,994 public repositories .
The core failure is portability. Claude Code tries to keep the local settings file out of git by adding it to the user’s global git ignore configuration, but Apiiro says that protection does not travel with the repository and does not help if the file has already been committed . The Hacker News reported that older versions remain in git history and forks even after deletion, making rotation more urgent than cleanup cosmetics . In other words, removing the file from the current branch is not enough; every credential that ever appeared there should be treated as exposed.
Why this matters beyond one file
The affected secrets are not only “developer junk drawer” tokens. Apiiro said examples included a database vendor’s admin-level cloud key, a production Azure Postgres password, a Square production token, an npm token, and the owner password of a medical-records database . The company said it did not use or test the credentials, so “real secret” means a value matching a provider format or paired with a public host, not proof that every credential was still valid . Still, even one live key can be enough for an attacker to enter a cloud account, clone private code, alter a package, dump a database, or pivot into production.
The scanner gap makes the incident worse. Apiiro said common tools missed a meaningful share of the exposed files: gitleaks flagged 564 of the 1,122 files with a real secret, TruffleHog flagged 643, and neither flagged 215 . The reason is practical: many secrets were plain passwords embedded inside commands such as database or SSH invocations, not recognizable provider keys with standard prefixes . That should change how security teams scan agent output. The risk is not only .env files; it is approval logs, memory files, transcripts, handoff notes, settings files, and any other place an agent records “what worked.”
A separate privacy bug: email addresses in User-Agent headers
The second issue is different in severity but similar in lesson. A GitHub issue opened on November 5 alleged that Claude Code sent the user’s email address to arbitrary third-party websites in the HTTP User-Agent header while conducting web searches . The reporter listed Claude Code version 2.1.318 on macOS and said the exposure coincided with scam emails . The claim matters because web servers routinely log User-Agent headers, which means an email address placed there may persist in access logs, analytics pipelines, SIEM systems, CDN logs, and vendor tools.
VibeIncidents summarized the current state on November 6: open GitHub issues reported signed-in account emails appearing in outbound User-Agent strings, and a contributor comment said a built-in privacy mod called cc-plugin-privacy had been introduced in v2.1.317 and later to block the behavior by default . But that same summary noted reports of gaps in 2.1.318 and said no CVE or GitHub security advisory had been found in its check . Tin Computer’s November 6 analysis also described the safeguard as limited, saying the mod documentation excluded paths such as WebFetch, WebSearch, MCP tools, scripts containing the address, values computed at runtime, and emails sent without a User-Agent reference .
The mechanism appears to be a model-and-harness interaction rather than a deliberate email-sharing feature. The GitHub thread includes a quoted explanation that scripted clients for sites such as Wikipedia may be asked to identify themselves with a contact email, and that Claude could use the signed-in account address when composing a curl command . Tin Computer framed the failure as the agent having access to the user’s login email and sometimes selecting it as contact information when a site policy asked for one . The practical fix is not “ask the model nicely”; it is to stop placing unnecessary personal data in agent context and to enforce outbound data rules outside the model.
A third surface: Dispatch and browser extensions
The third report widens the issue from data leakage to code execution risk. The Register reported on November 5 that Forever Security researcher Gal Weizman found Claude Dispatch’s interface and API reachable from an ordinary logged-in claude.ai web session, allowing a browser extension with access to the page to send commands to Claude Desktop as if they came from the legitimate user . Claude Dispatch is designed to send tasks from a phone or browser to Claude Desktop, which can run commands on the user’s computer .
The Hacker News reported on November 6 that the attack required an extension able to run scripts on claude.ai, a user signed into both claude.ai and Claude Desktop, and Dispatch enabled . In the proof of concept, a script opened Dispatch, sent prompts asking Claude to install an npm package, auto-clicked “Allow” prompts, and the package’s install script opened Calculator . The demonstrated payload was benign, but both reports emphasized that the same path could be used for more serious actions if Claude Desktop had access to files, credentials, source code, or authenticated sessions .
The cross-device angle is especially concerning. The Register said Dispatch could let a compromised browser session on one machine direct Claude Desktop on another machine signed into the same Claude account . That turns a browser extension problem into a potential workstation foothold, especially when personal Claude accounts bridge home and work devices . Browser extensions have always been sensitive; AI desktop agents make them more sensitive because a page-level automation path can become an operating-system action path.
What developers should do now
The immediate response starts with inventory. Search for .claude/settings.local.json, .claude/settings.json, agent transcripts, .specstory, memory files, and handoff notes across public and private repositories, including history and forks . Rotate first, then remove: if a credential appears in any committed file or git history, assume it may have been copied . Add .claude/settings.local.json to repository-level .gitignore templates, not only global excludes .
For live Claude Code use, stop putting raw secrets in commands. Prefer environment variables, secret managers, short-lived credentials, and command patterns that do not serialize values into approval files . Review Claude Code permission rules, avoid approving exact commands that contain secrets, and treat “don’t ask again” as a write to a local policy file, not as a harmless UI shortcut .
For the email issue, update Claude Code, check whether the privacy mod is present and enabled, and do not assume it is a complete boundary . Search local transcripts and logs for your email address, set explicit instructions for approved contact addresses, and use project-controlled public contact aliases where a site genuinely requires one . For Dispatch, disable cross-device features where they are unnecessary, restrict browser extensions that can run on claude.ai, and monitor unexpected package installs or command execution from Claude Desktop .
The broader lesson is blunt: AI coding agents are now part of the software supply chain. Their convenience files, headers, browser bridges and approval prompts deserve the same threat modeling as CI runners, package managers and cloud CLIs. Permission prompts were supposed to be the safety rail; this week, they became part of the incident.
Comments
Be the first to comment.