AI Agents Trends: Saved Approvals Put 2,539 Secrets on GitHub as Vendors Rebuild the Approval Step

Security firm Apiiro reported that 2,539 real secrets sit in 1,994 public GitHub repositories because of one approval option in Claude Code, Anthropic's coding agent. When a user answers a permission prompt with “Yes, and don't ask again,” the agent saves the exact command, including any password or key inside it, to a settings file in the project folder. In the same eight days, DigitalOcean shipped an iPhone app for answering agent approval requests, CrowdStrike shipped a control that stops a running agent, and the Linux Foundation launched a standard for verifying which organization an agent belongs to.

All four items concern the same part of an agent workflow: the point where a person says yes, no or stop. For a solo operator or a small team, that point is usually the only review an agent's action gets.

What Apiiro found

Apiiro searched public GitHub between November 1 and 3 and found 104,185 copies of the file .claude/settings.local.json in 103,617 repositories. Of those, 1,122 files held at least one real secret, for 1,379 distinct secrets: 636 provider keys and 743 passwords or tokens stored next to a public host. Adding earlier versions of the file in git history, the shared settings file that teams commit on purpose, and saved agent transcripts brought the total to 2,539 secrets in 1,994 repositories.

More than a third of the secrets in the current files open a database directly: 379 database passwords and 122 Supabase service-role keys. Apiiro counted 63 affected organizations, from student groups to startups, software agencies and established vendors, and said most of the secrets belong to individual developers. One organization confirmed its key had been live.

The mechanism is ordinary use. A developer asks the agent to check a database or call an API. The command the agent proposes carries the credential, because the command cannot work without it. Claude Code's permissions documentation describes how a saved approval becomes a rule in the local settings file at the root of the repository. Apiiro showed that the rule is the command string itself. The agent adds the file to the developer's global git ignore list when it creates it, but not to the repository's own ignore file, so the protection does not follow the project to another machine or cover a file that was already committed. In 539 of the 1,105 repositories Apiiro traced, a commit co-authored by Claude changed the file.

Standard scanners caught only part of it. Of the 1,122 files, gitleaks flagged 564 and TruffleHog flagged 643, and 215 were flagged by neither. Apiiro attributes the gap to passwords typed inside commands, which have no recognizable key format.

Apiiro's post quotes Boris Cherny, Anthropic's head of Claude Code, responding on Hacker News on November 7. He wrote that the team is “looking into what we can do to prevent this” and plans to prototype approaches that include basic secret scanning.

What shipped around the approval step

DigitalOcean Cuttlefish. On November 5, DigitalOcean introduced Cuttlefish, an iPhone app for its Managed Agents service, which is in public preview. The app sends a notification when a run needs approval, finishes or fails. The approver sees the full command, file path or diff rather than a summary, and requests classified as high risk require Face ID or a passcode. A user can also pause, resume or stop a session.

CrowdStrike AI Kill Switch. On November 3, CrowdStrike announced a kill switch in its Falcon Guardian product. An authorized administrator can terminate a running agent, block it from launching again and cut its network access, and each action is recorded in an audit trail. The product is sold to corporate security teams. The design is the relevant part for smaller operators: the stop control sits outside the agent and does not depend on the agent agreeing to stop.

Agent Name Service. On November 10, the Linux Foundation announced that Agent Name Service launched as a foundation project. The open standard uses existing DNS infrastructure to name, register and verify AI agents, so that a system receiving a request from an agent can check which domain and organization stand behind it. Eleven organizations have contributed to or adopted it, including Cisco, Cloudflare, DigiCert, GoDaddy and Salesforce.

What this means for a small operation

Apiiro describes the cause of the leak as prompt fatigue. Its post says the agent asks before running a shell command many times in a session, and that after repeated interruptions most people stop reading the commands. The saved approval removes the interruption, and in this case it also wrote the credential to a file.

The DigitalOcean release takes the opposite approach. It keeps the prompt and makes it possible to answer from a phone, with the full command visible. The approval loop pattern covered earlier on this site describes where review steps belong in a small business workflow, and the analysis of persistent agents covers agents that keep working while the operator is away, which is the situation mobile approval is built for.

Practical steps

The following steps are general guidance drawn from the sources above. The first four come from Apiiro's recommendations.

Check the settings file in every project. Open .claude/settings.local.json and read the allow list. Each entry is a command that was approved, with whatever was typed into it. Delete any rule that contains a password, token, key or connection string.

Rotate first, then clean up. If the file was ever committed, removing it does not clear git history, forks or clones. Apiiro found 734 secrets that exist only in earlier versions of files. Every credential the file has held should be replaced, and the file should be added to the repository's own ignore file so the rule travels with the project.

Keep secrets out of commands. Apiiro recommends referencing a secret as an environment variable, so that a saved rule records a name such as $DB_URL and not the value.

Approve patterns, not literal commands. A rule such as Bash(npm run:*) covers a family of safe commands and contains no credential. The site's guide to permissions and human review boundaries covers how to decide which actions an agent may take without asking.

Treat agent folders like a credentials file. Apiiro found secrets in agent transcripts, memory files and handoff notes as well, and a third of the handoff notes containing a secret were written by the agent. Folders an agent writes to deserve the same handling as a .env file.

Know how to stop a run. Each tool has its own stop control. An operator should find it and test it before starting a long session, as covered in the guide to recovering a failed agent run. Readers new to the category can start with the agent fundamentals.

What to watch

Anthropic has said it will prototype changes and has not announced a fix or a date. Apiiro reported that it compared how 16 coding agents store approvals from their documentation and that Claude Code is the only one confirmed to write the full approved command to a project file by default.