Claude Code’s “Don’t Ask Again” button reportedly left 2,539 secrets in public GitHub repos

😁 Hello, super humans! The fastest way to leak a password this week was to click a button that promised to stop bothering you. Apiiro says Claude Code’s “don’t ask again” permission writes the full approved command into a local settings file, and thousands of those files ended up on public GitHub. We cover what is confirmed, what rests on secondary reporting, and a ten-line script to check your own repos before someone else does.

📰 Quick Signals

• 🧠 AI: llama-modchip is an Apache 2.0 project that runs a 284B-parameter DeepSeek V4-Flash model on a CPU-only 64GB machine, with reported generation of 9.1 to 14.7 tokens per second.
• 🤖 Robotics: XPeng says its IRON humanoid finished automated assembly and walked off the line, with mass production targeted for late 2026 and sales in 2027.
• 💻 Programming: TypeScript 7.1 Beta restores the compiler API removed in 7.0 and adds content mappers for Vue and Svelte; one Vue project’s type check fell from 14.19 to 3.10 seconds.
• ⚡ Electronics: Chip startup funding is tracking about $8.4B of private money in Q1 2026 alone, a reminder that AI silicon is where the capital is going.
• 📡 Telecom: Qualcomm expects its SpaceX deal to start contributing revenue as it exits fiscal 2027, with fiscal 2028 the bigger year; SpaceX picked it for radio and baseband in Starlink’s US terrestrial 5G build.

🔍 The Big Story: Claude Code’s “Don’t Ask Again” button reportedly left 2,539 secrets in public GitHub repos

If you use an AI coding agent, there is probably a local settings file in your repo that you never opened. This week researchers argued it is quietly collecting your credentials.

What happened: Security firm Apiiro published a report, summarized by The Hacker News and discussed on Hacker News, saying that choosing “Yes, and don’t ask again” in Claude Code saves the full approved command, secrets included, in plaintext to .claude/settings.local.json. That file is not in .gitignore by default. Read the original in Apiiro’s report.

The details: Per the coverage, Apiiro scanned 104,185 public copies of the file and found real credentials in 1,122 of them: 2,539 distinct secrets across 1,994 repositories, including 379 database passwords, 23 AWS keys, 42 GitHub, GitLab or npm tokens and 43 SSH logins. It also says half the exposed files had sat on default branches for at least 217 days, and that four related reports to Anthropic were auto-closed by a bot without a reply. The mechanism is simple: an approval rule matches an exact command string, so if the command contains --password hunter2, the rule contains it too.

flowchart LR
    A[Agent proposes a shell command with a credential] --> B[You click Yes and don't ask again]
    B --> C[Full command saved to .claude/settings.local.json]
    C --> D[File not gitignored by default]
    D --> E[git add and push]
    E --> F[Secret public on GitHub]

🗞️ More News

🧠 AI

• Nvidia’s board opened an independent-director inquiry with outside counsel into reports about CEO Jensen Huang; it says there is no evidence Nvidia secrets were compromised.
• The Financial Times reports Anthropic committed about $3.4B to take over 1.7 GW of heavy-duty gas generators originally ordered by OnePWR Solutions from Caterpillar.
• Anthropic is emailing enterprise customers that an outside security research firm accessed internal systems in late October and viewed account IDs, plan tiers and usage metrics; conversation content and payment data were reportedly not included.
• DeepSeek told Bloomberg its open-source agent app Harness hit 1.54 million daily users on Nov 4 and processes roughly 92 trillion tokens a day.
• An SHL survey found 19.1% of US workers displaced by AI were later asked back by their old employers, and about half of returnees demanded substantial raises.
• Malbear Labs details Operation Snowball: an autonomous AI agent on DeepSeek Flash reportedly worked a Cisco BroadWorks target (CVE-2026-20320) and rewrote its tooling when antivirus blocked it; the findings are the researchers’ own reading.
• Tencent’s chief AI scientist Yao Shunyu said cyber capability has crossed a harm threshold and biology capability may follow, and that Tencent plans to publish Hy4 weights with a safety report.

🤖 Robotics

• Audi is trialing Agile Robots humanoids for parts sequencing in Ingolstadt, using a small lab fleet.
• Tau Robotics is charging for humanoid cleaning visits in San Francisco; remote human operators do the work while the data trains more autonomous robots.
• Xiaomi says two humanoids covered a factory station’s daily needs sorting flexible car panels over an eight-hour run with two charging stops (company-reported).
• Agility Robotics closed its SPAC merger ahead of a Nasdaq debut and is preparing a new humanoid.

💻 Programming

• OpenSSH 10.6p2 works around a critical bug on musl-based Linux with PAM disabled (such as Alpine); until patched, set PasswordAuthentication=no.
• Asahi Linux moved all repositories from MIT to GPL-2.0-or-later, citing code copied from forks without attribution or rewritten with LLM help.
• Seven stable kernels (7.3.3 down to 5.10.274) fix three Xen use-after-free bugs, two of which can cause host-wide denial of service.
• GitHub Actions lockfiles reached general availability on Oct 28, letting workflows pin dependencies while keeping tag and branch references.

⚡ Electronics

• Marvell’s Lumentum acquisition is read by TeckNexus as a sign that optical interconnect is now core to AI infrastructure.
• Nvidia, Rebellions and SK Telecom signed an NVLink Fusion MoU pairing Rebellions R200 NPUs (decode) with Nvidia GPUs (prefill), with R200 deployment targeted for 2028.
• Vertical Compute, an imec spinoff, raised EUR 37M for 3D vertical memory aimed at AI workloads.

📡 Telecom

• Deutsche Telekom’s CEO says he takes SpaceX seriously as a new US mobile competitor, as the carrier reports Q3 earnings.
• Ericsson is moving mmWave radio production from the US to Estonia.
• Verizon and Ericsson’s AI-RAN intelligent controller rollout is framed as RAN automation moving from pilots to platform.
• RCR Wireless argues NTN-native 6G will feel seamless but not identical to terrestrial service, with one integrated experience expected by the early 2030s.

👨‍💻 Code Corner

Scan your own repos for approval rules that smuggled a secret into the agent settings file. This prints only a masked preview, never the secret.

import json, pathlib, re

PAT = re.compile(r"(password|passwd|token|secret|api[_-]?key|AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{36})", re.I)

for f in pathlib.Path(".").rglob("settings.local.json"):
    rules = json.loads(f.read_text()).get("permissions", {}).get("allow", [])
    for rule in rules:
        if PAT.search(rule):
            print(f"{f}: suspicious rule -> {rule[:25]}...")

Run it from the root of each project; any hit means rotate that credential, then delete the rule.

🧰 Toolbox

• Gitleaks: scans repos and git history for committed secrets; the natural follow-up to today’s story.
• OpenBao 2.7: the Vault fork adds external HSM and KMS keys, PostgreSQL read scaling and post-quantum algorithms.
• Topcoat: Tokio’s server-rendered full-stack Rust framework at v0.9; it translates Rust expressions to JavaScript instead of using WebAssembly, and releases are unstable.
• pg_vectorsearch: an alpha PostgreSQL extension that uses a PRISM index instead of pgvector’s HNSW to cut memory and build time, per the vendor.
• Bumpy: an MIT-licensed, file-based TypeScript tool for monorepo versioning and changelogs.

🎬 Demo Watch (rotating)

This one is a paper, not a video: Weight-Space Programming from Shanghai AI Lab, Tongji and Fudan. Instead of training a model with gradients, a reasoning agent inspects the weights and edits them directly. On Qwen3.5 models (0.8B and 9B), one edit of 1,023 parameters reportedly lifted MATH-500 by 29.45 points, with gains of 36.72 on IFEval and 17.11 on SciBench across 16 trajectories. The catch worth noting: 6 of the 16 trajectories reverted to the original weights because the candidate edits could not be validated, and the results are on small models. Promising, but it is a single paper that has not been replicated.

📚 From the Blog

• Turning Pixels Into Something the AI Can Eat: Episode 3 of the camera series, picking up once the pixels have left the camera and crossed the network.
• Building Your First Neuron From Scratch: Part 2 of the neural network series, building on the idea of nudging weights to lower the error (a nice companion to the Weight-Space Programming paper above).
• The Network Behind the Cameras: the unglamorous plumbing of moving pixels across a network without choking it.

😀 The Bot Says…

In Operation Snowball, the operator’s whole job reportedly came down to typing “Go on” while the AI picked the exploits. Somewhere a human is putting that on a résumé as “managed a team of one.”

---

That’s all for today! Check your .claude folder before your next push, and reply with the weirdest thing you have found in a dotfile.