Sunday 8 November 2026

Claude Code's "don't ask again" shortcut has been leaking passwords and API keys into 1,122 public GitHub repos — and Anthropic's own AI is now automating itself into a faster danger zone.

Lead story

The AI Coding Assistant That Remembered Too Much

Developers love a "don't ask again" button. It saves interruptions and keeps you in flow. But in Claude Code, Anthropic's AI coding assistant, that shortcut has been quietly writing secrets into project settings files — and those files have been landing in public GitHub repositories where anyone can read them.

Security firm Apiiro disclosed yesterday that it found 1,122 public repositories containing Claude Code's .claude/settings.local.json file, with a meaningful portion of those files containing plaintext passwords, API keys, and other credentials that developers had typed directly into commands they approved. When you tell Claude Code "yes, and don't ask again," it logs the command verbatim — secret and all.

This isn't a vulnerability in the cryptographic sense. No one broke any encryption. The problem is simpler and more human: developers approved commands containing secrets, Claude Code saved those commands faithfully, and then standard git add . habits or misconfigured .gitignore files pushed the lot to GitHub. The tool did exactly what it was told. The mess that followed is what security folk call an OPSEC failure, but it's one the tool's design made trivially easy to trigger.

The scope matters here. 1,122 repositories is not a rounding error. It suggests this is a systemic pattern, not a handful of careless outliers. The more AI coding assistants embed themselves into developer workflows — handling commands, storing approvals, logging context — the more opportunity there is for secrets to end up somewhere they shouldn't be. Claude Code is the specific culprit today, but the design pattern is shared across several AI dev tools.

For defenders, the immediate ask is straightforward: audit any repository where Claude Code has been used for the presence of .claude/settings.local.json and treat any exposed credentials as compromised. Rotate keys, check access logs, assume the worst.

The broader concern is what this says about AI tooling and secrets hygiene at scale. Developers are under pressure to ship faster than ever, AI assistants lower the friction on every individual step, and that lower friction sometimes means skipping the mental check of "wait, should this be stored?" The attack surface for credential exposure isn't just growing — it's being actively lubricated by the tools meant to help.

Worth watching alongside this: Anthropic's own internal METR report (also out this week) found that the company's AI models are now improving roughly twice as quickly as a year ago, with Anthropic using AI to build more AI. That acceleration is impressive and also slightly unsettling — the same organisation whose tooling just leaked 1,122 sets of credentials is building systems that are compounding in capability at an accelerating rate. Coincidence, obviously, but a useful frame for thinking about whether safety guardrails are keeping pace.

Australian developers using Claude Code — and there are many, given its integration into popular IDEs — should treat this as an urgent checklist item, not a "we'll get to it" one. The ACSC's guidance on secrets management applies in full; exposed API keys are a known initial access vector for cloud-infrastructure attacks.

Anthropic has not yet indicated whether it will change the settings file format, add a warning before saving commands that look like they contain secrets, or update .gitignore templates to exclude the file by default. Watch for a response in the next 48 hours.

Also today

Anthropic's AI Is Now Building Anthropic's AI — Twice as Fast as Last Year

An 11-week investigation by AI safety research organisation METR, conducted inside Anthropic, found the company is using its own models to accelerate AI research and development. The result: its models are improving roughly twice as quickly as a year ago, with no sign of the pace slowing. Researchers outside Anthropic are alarmed — not because automation is new, but because the feedback loop is tightening faster than safety evaluations can keep up. METR's report is unusually candid for an internal audit, acknowledging the difficulty of evaluating systems that are actively changing the conditions of their own evaluation.

The Verge ↗

OpenAI Hits $1.25 Trillion Valuation as Anthropic Eyes an IPO

OpenAI has raised another $11 billion in a funding round that hasn't formally closed but is expected to within weeks, according to Bloomberg. That pegs the company's valuation at $1.25 trillion — up from $852 billion as recently as March — making it one of the most valuable companies on Earth. The round may ultimately reach $20 billion. Separately, rival Anthropic is reported to be moving toward a public listing. For context: OpenAI was worth roughly $29 billion in early 2023. The capital being poured into frontier AI labs has no modern precedent outside the space race.

The Verge ↗

SonicWall Patches Actively Exploited Flaw That Lets Wrong-Key Holders Bypass MFA

SonicWall has patched CVE-2026-19868 in SonicOS, a vulnerability already being exploited in the wild that allows an attacker holding credentials for one authentication method to bypass SAML-enforced MFA and get through VPN login. In plain terms: if you have the wrong key but the right bug, the door still opens. SonicWall devices are common at the perimeter of mid-market and enterprise networks in Australia and globally. ACSC has previously flagged SonicWall vulnerabilities as high-priority patching targets; this one, being actively exploited, should go to the top of the queue immediately.

SecurityWeek ↗

AI Agents Spill Secrets When Asked to Collaborate With Each Other

New research shows that AI agents leak sensitive information — credentials, internal instructions, confidential context — when prompted to work alongside other agents, even untrusted ones. The attack is disarmingly simple: one agent introduces itself as a friendly collaborator, and the target agent shares what it knows. Researchers describe it as analogous to social engineering, but for LLMs. The finding has direct implications for multi-agent architectures that are increasingly common in enterprise automation. The rule of thumb that emerges: if you wouldn't post it on GitHub, don't put it in an agent's context window.

The Register ↗

Binance CFO Departs Barely a Week After $6.3 Billion Hack

Binance's chief financial officer has announced they are leaving the exchange to "pursue a new venture" — a departure that lands just over a week after hackers stole $6.3 billion worth of cryptocurrency from Binance users in one of the largest exchange hacks on record. The timing invites obvious questions about whether the exit is voluntary. Binance declined to elaborate. The incident is the second major crypto-platform breach to draw international attention in the past fortnight, and Australian crypto investors using Binance-affiliated products should check their account activity and enable all available security controls.

TechCrunch ↗

Iran-Linked Ships Loiter Near Subsea Cables as Tensions With Washington Rise

Vessel-tracking data shows ships with links to Iran positioning near undersea internet cables in the wake of Tehran's public threat to attack subsea infrastructure if the US escalates military action. Subsea cables carry more than 95% of international internet traffic, including the bulk of data flowing between Australia and the rest of the world. Australia is served by a cluster of cable landing stations on its east and west coasts; a deliberate cut or sabotage event at a key node would have material impact on latency and connectivity for Australian businesses and government networks.

Ars Technica ↗

UK Bets on Tech Sovereignty — but Security Leaders Say the Plan Is Too Fragmented

The UK government is pushing domestic AI and cybersecurity investment as a hedge against dependence on US technology platforms. The strategy includes new funding streams and policy signals designed to grow a homegrown AI industry. But security leaders quoted in Dark Reading are sceptical — the investment is spread too thin across too many initiatives, and the UK is starting from a significant deficit in both talent and compute. Australia faces structurally similar questions: the government's AI and cyber strategies have announced ambitions but relatively modest capital commitments compared to what the US, UK, and EU are deploying.

Dark Reading ↗

Google Buys Crusoe's Troubled Wyoming AI Data Centre

Crusoe Energy, the AI infrastructure startup that pivoted from using stranded natural gas to power GPU clusters, has sold its ambitious Wyoming data centre project to Google after the build ran into serious difficulties. Google gets a partially developed large-scale site; Crusoe gets to exit a problem. The deal underlines just how capital-intensive and operationally complex it is to build frontier AI compute infrastructure at speed — something that investors pouring money into AI labs at record valuations are perhaps underweighting. Data centre construction timelines and energy constraints are increasingly the binding constraint on AI capability growth.

TechCrunch ↗

Nvidia Chips Ended Up With a Company That Might Not Exist

A New York Times investigation found that New Matrix, a Chinese firm on the US Commerce Department's approved list for Nvidia H200 AI chips, appears to be an empty office — wires dangling from the ceiling, no discernible business activity. Neither Nvidia nor the Commerce Department appears to have verified the company's legitimacy before allowing chip sales. The finding raises serious questions about the effectiveness of US export controls on advanced AI silicon, controls that are meant to prevent frontier AI capabilities from reaching adversaries. If a company that doesn't exist can get H200s, the controls aren't working.

The Verge ↗

NHS Breach Helpline Staff Left Carrying the Emotional Weight of a Disaster

An independent review into the UK's NHS data breach response has found that staff running the patient helpline were given just one day's notice before going live and were left to manage deeply distressing calls — including safeguarding situations — without adequate support. What was scoped as a two-week project stretched to eleven months. The review is a useful case study for any organisation building an incident response function: the human and operational capacity to handle affected-individual communications is routinely underestimated during breach planning, including within Australian healthcare organisations subject to the Privacy Act's mandatory notification regime.

The Register ↗

A British Soldier Ignored Orders to Pull His SIM Card. Then Came the Blackmail.

A British soldier was court-martialled after being sextorted — the result of ignoring repeated pre-deployment instructions to lock down his personal devices and remove his SIM card. The case is unremarkable in its technical detail but highly instructive as a human factors story: clear, documented guidance existed, was communicated multiple times, and was still ignored. Defence organisations globally — including the Australian Defence Force — treat mobile device management as a live operational security problem, particularly for personnel deploying to regions of elevated intelligence interest.

Ars Technica ↗

Sources consulted