Claude Code's "Don't Ask Again" linked to passwords in 1,122 public GitHub files
Follow-up to Friday Nov 6: Claude Code reportedly sends your email address to websitesTwo days ago, we covered a bug report saying Claude Code sends your email address to websites. Now there is a bigger leak, and this one is about passwords. The security company Apiiro published a report on coding agents leaking secrets. Its title: "Claude Code's 'Don't Ask Again' exposes passwords in 1,122 public GitHub files." It got 393 points and 270 comments on Hacker News.
"Don't ask again" is the option that lets a coding agent do something without asking you each time. It saves time. According to Apiiro, it is also linked to passwords in 1,122 files that anyone can read on GitHub. Our sources do not include a reply from Anthropic yet.
The same week, The Verge published a podcast titled "AI broke the cybersecurity world." In it, Alex Stamos, chief security officer at Cognition, talks about what a mess security is right now. If you use a coding agent, check your project files before you push them. Change any password that may be exposed.
Every "don't ask again" moves a little trust from you to a machine. October brought one agent incident after another, and November keeps the pace: an email address on Friday, passwords today. Convenience buttons are becoming the new open door.
