Claude Code's 'Don't Ask Again' Button Has Been Leaking Passwords Into Public GitHub Repos
How this was made Verified AI
Every Intellegix briefing is generated from that day's broadcast and run through automated checks before it publishes — with a human paged on any flag. Here is the trail for this edition.
Security researchers at Apiiro have linked a behavioral pattern in Anthropic's Claude Code agent to the exposure of credentials in more than 1,122 publicly accessible GitHub files, according to research drawing 287 comments on Hacker News. The issue is not a vulnerability in the conventional sense but a mechanic: when users click 'Don't Ask Again' to suppress permission prompts during automated workflows, the agent proceeds with file writes and commits without further confirmation — and in some workflows, that apparently includes writing configuration files containing plaintext secrets passed into the agent's context.
Apiiro researchers reported that by searching GitHub for structural signatures associated with Claude Code's output — file naming conventions, comment styles, and certain code patterns — they were able to surface files containing what appear to be real API keys, database connection strings, and internal service tokens. Those files, the researchers noted, exist publicly at the time of the report. Anthropic had not formally responded to the findings as of Sunday morning.
The Hacker News discussion centered on the 'Don't Ask Again' framing itself: the label implies the confirmation prompt was merely annoying, without surfacing that the prompt was performing security work. The pattern is familiar across automation tooling — a user opts out of friction, unaware that the friction was protective. Commenters noted that the incident illustrates a structural gap in how AI agents operate in production: in a demo context, a human is watching; in an overnight workflow, the agent is operating autonomously, and decisions made silently may not be reviewable after the fact.
A related post, drawing less traffic but substantive discussion, argued that the field needs an 'OpenTelemetry moment' for agent memory — a reference to the open standard that brought coherence to distributed systems observability. The argument: if there were a standardized way to audit what context an agent held at the moment it made a decision, investigators could answer whether Claude Code had credentials in its context window when it committed a given file. Currently, that question is essentially unanswerable after the fact.
A separate but conceptually linked story, the MaxxBench research post earning 329 points and 84 comments, challenged the integrity of AI coding benchmarks under the headline 'Nice DeepSWE score. But is it true?' The researchers argued that DeepSWE and similar evaluations drawing on real GitHub issues are vulnerable to data contamination, because popular repositories have already been ingested by most model training pipelines, making ostensibly 'real' tasks potentially familiar to the models being tested. Practitioners commenting in the thread reported consistent gaps between published benchmark rankings and actual utility in internal codebases — a purchasing risk, the discussion suggested, that has not yet been priced into enterprise procurement decisions.