Vector Wire analysis published November 11, 2026; Apiiro findings covered November 10, 2026; Claroc Grok Build research published November 10, 2026; GitGuardian scan window January 2025 to November 7, 2026
The Agent Wrote the Password Down: Claude Code Settings, Grok Build Links and the Design Defaults That Spill Secrets
Three platforms, three different mechanics, one design pattern: the layer between a model and a working environment collects secrets and then stores or shares them in places older tooling does not watch. In the Claude Code case, the mechanism is a convenience feature: approving a shell command with the do-not-ask-again option writes the command, including any password or token inside it, word for word into the local settings file .claude/settings.local.json. Apiiro found 1,379 secrets in 1,122 of 104,185 public copies of that file on GitHub, and 2,539 secrets across 1,994 repositories when history, shared settings, transcripts and related files are counted. GitGuardian, scanning public commits from January 2025 through November 7, 2026, counts 31,088 distinct secrets in Claude Code settings files, 5,343 of which passed its validity checks; the analysis notes the two totals reflect different methods and windows rather than a contradiction. A vendor safeguard that lists the file in a global ignore file plainly did not hold at this scale. Grok Build fails at the sharing layer instead: Claroc found that of 43,551 app addresses under the grok.me domain, 37,571 were still online and 35,578 of those, 94.7 percent, opened to anyone without sign-in, because each app hostname is visible in public DNS records and the default sharing setting is anyone with the link. The open material included source code, embedded data and ingested credentials, plus sensitive material from 30 other organizations, and 24 apps built by the vendor own staff. The Railway breach, covered above, supplies the demand side of the same market: attackers automated a hunt for exactly these keys.
Executives
This is a defaults problem, and defaults are a governance decision your teams make by not making one. Coding agents now sit inside real repositories holding real credentials, and their convenience features write those credentials into files and shareable artifacts by design. Set the organizational defaults explicitly: which agents may run, where their settings and transcripts are stored, whether shared app links leave the building, and who reviews the first deployment of each new tool. The cost of the review is an afternoon; the counted cost in the neighboring story was $740,000 on one platform alone.
CIO / CISO
Add the agent layer to the secrets program by name. Scan repositories and endpoints for agent settings files, transcripts and handoff files, not only the classic config names, and treat any committed settings.local.json as a rotation event, not a cleanup ticket. Set scanning to flag secrets in agent artifacts in the pipeline, require private-by-default sharing on app builders, and inventory which agent tools hold standing credentials versus per-session ones. The GitGuardian validity figure, 5,343 live credentials, is the metric to quote when the pushback is that committed means expired.
Engineers
Check your own footprint today. Search your repositories and their history for .claude/settings.local.json and related agent files, rotate anything they contain, and rewrite history where the platform requires it, because deleting the file in a new commit leaves the secret in the old one. Stop approving commands that carry inline secrets; pass credentials through the environment or a secrets manager so the written record holds no value. For any app built on a sharing-by-link builder, set the link to invited users or private and assume a public hostname is an enumerated hostname.
Everyone (non-IT)
If you use a coding assistant, one habit protects you more than any setting: never type a real password or key inside a command you approve, because the tool may save that command, word for word, in a file that can later be shared or uploaded. The same applies to share links for apps the assistant builds for you: open the sharing setting and check who can view it before you send the link anywhere. When in doubt, ask your IT team which AI tools are approved and how they want credentials handled.