Exposed Credentials

Researchers find 1,122 exposed credentials in public repos linked to Claude Code setting

Security researchers reportedly identified 1,122 public GitHub files containing exposed passwords and credentials tied to use of Claude Code's 'Don't Ask Again' permission setting. The feature appears to let the AI coding assistant bypass repeated confirmation prompts, which in these cases allowed sensitive secrets to be committed to public repositories. The finding was published via Apiiro, an AI application security firm.

apiiro.com · 2026-11-07

Fake AI-bot scanner probes 48% of Cequence-protected firms for leaked credentials

Cequence Security's CQ Prime Research found a threat actor impersonating 32 AI bots—including ones mimicking OpenAI, Anthropic, Perplexity and Meta—to search organizations for exposed passwords, API keys and cloud credentials. The scanner has run since late September, hit firms across retail, finance, telecom, energy and software, and on Oct. 21 alone reached 48% of Cequence-protected organizations, though nearly all requests were blocked or failed.

darkreading.com · 2026-10-28