Remembering permission to run a command can also preserve the command's sensitive arguments. Apiiro's investigation, published November 5 and updated November 8, describes literal credentials copied into .claude/settings.local.json when Claude Code saves approved shell commands. Subsequent tracking or copying can expose those values even when the original…
Case · DiggingBeagle record
Claude Code remembered approvals copied secrets into public settings files
Apiiro traced probable secrets in public repositories to complete shell commands saved as approval rules. The scan documents disclosure, not a count of confirmed account takeovers or currently valid credentials.
Public disclosure: Nov 5, 2026
Scope
Vulnerability reported in a controlled research or disclosure setting. Exact prerequisites, versions and absence of documented exploitation must be preserved.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The cited first-party advisory or research establishes the stated mechanism only within its documented conditions. No unrelated production compromise, extended victim scope, financial harm or universal mitigation is inferred.
Assessed Nov 9, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CLAUDE-APPROVAL-SECRETS-SCAN · CLM-CLAUDE-APPROVAL-CONDITIONS · Apiiro public repository scan of saved Claude Code approval commands
At a glance
Executable permissions can retain sensitive command arguments, even when the original .env or secret manager file is protected.
Read the implicationsThe report did not use captured credentials; one notified organization confirmed that a sampled key had been live. No broad downstream account compromise established.
Limits and uncertaintyFull account
Remembering permission to run a command can also preserve the command's sensitive arguments. Apiiro's investigation, published November 5 and updated November 8, describes literal credentials copied into .claude/settings.local.json when Claude Code saves approved shell commands. Subsequent tracking or copying can expose those values even when the original secret store remains private.
The scan covered 104,185 public settings-file copies and found 1,122 containing secrets. Its broader repository analysis reported 2,539 probable secrets across 1,994 repositories. These count different objects: neither figure is the proportion of all Claude Code users affected. A notified organization confirmed one sampled credential had been live; the researchers did not use captured credentials or establish widespread downstream compromise.
Permission records are sensitive configuration
An ignore rule does not remove an already tracked file, and deleting a published copy does not revoke the credential. Preventing future literal-secret persistence, reviewing tracked configuration and invalidating exposed keys are separate actions. Those implications follow from the disclosure path; they are not proof that every stored command contains a secret.
Anthropic's reported response about secret scrubbing is not a verified universal fix. This configuration exposure is also distinct from the earlier client-source disclosure and histories found on ARTEX infrastructure, which involve different assets and operators.
Mechanism and trust boundary
- 01
A developer runs a command containing a literal API key or secret and approves recurring agent execution.
- 02
The agent stores the entire accepted command in .claude/settings.local.json instead of removing the secret from its permission rule.
- 03
The settings file becomes tracked, copied or otherwise exposed when local exclude rules are absent or bypassed.
Claims & evidence
CLM-CLAUDE-APPROVAL-CONDITIONSClaude Code can persist a complete approved shell command when the user selects a remember-approval option, potentially copying literal credentials into project-local settings.supported
Basis: reported finding
- supportsApiiro public repository scan of saved Claude Code approval commandsprimary disclosure
How secrets get persisted: Bash allow rules and settings.local.json
CLM-CLAUDE-APPROVAL-SECRETS-SCANApiiro reported 2,539 probable secrets across 1,994 public repositories with saved Claude Code approval commands; the scan is a classification result and not proof that every credential remains usable.supported
Basis: reported finding
- supportsApiiro public repository scan of saved Claude Code approval commandsprimary disclosure
Apiiro survey: 2,539 probable secrets, 1,994 repositories and 104,185 settings files
CLM-ENR231-CLAUDE-SCAN-DENOMINATORApiiro reports scanning 104,185 public copies of the project-local settings file, with 1,122 containing at least one real secret; the wider set it describes totals 2,539 secrets in 1,994 public repositories.supported
Basis: reported finding
- supportsApiiro public repository scan of saved Claude Code approval commandsprimary disclosure
Published report, opening scan findings and secret counts
Implications
Executable permissions can retain sensitive command arguments, even when the original .env or secret manager file is protected.
Controls and mitigations
- Remove embedded secret literals from approval rules, sanitize stored approvals, audit existing tracked project settings and rotate exposed credentials.
Unknowns and contradictions
- The report did not use captured credentials; one notified organization confirmed that a sampled key had been live. No broad downstream account compromise established.
Sources and citation
Material revision history
- Nov 9, 2026 · Published version · first publication · revision 233