Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
Source: The Hacker News · 2026-11-07 (Apiiro research)
When a user selects “Yes, and don't ask again,” Claude Code can save the full approved shell command — including secrets — in .claude/settings.local.json. Apiiro found secrets in 1,122 public copies (~1.1% of ~104k files), totaling ~1,379 distinct values; one notified company confirmed a key was live.
Claude Code may add the file to a user's global git excludes but does not add project .gitignore. Broader scans including history, shared settings, and transcripts reached ~2,539 secrets across 1,994 repos.
Remediation: rotate every exposed credential first; then untrack the file, add .gitignore, prefer pattern approvals and secret-manager variables over exact commands containing secrets.
https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.htmlReposted. Will be removed on request. All rights belong to the original author.
More from this batch
Why a new report on Anthropic automating AI development is alarming researchers
METR’s 11-week look inside Anthropic: ~1.9× faster progress, mostly AI-assisted R&D; heavy redactions; RSI ban talk.
The US let Nvidia sell chips to an empty office in China
NYT: approved H200 handler New Matrix has an empty Beijing address; owners tied to a 2024-blacklisted PE.
OpenAI testing business tools to track performance within ChatGPT
Unannounced Business Hub analytics: daily impressions/clicks for verified businesses; no prompts or competitor ranks.
开发者反馈 Claude Opus 5.5 真实编码「掉档」：指令漂移、幻觉、过度拆子代理；固定基准未必同步掉
趋势聚合：中旬后真实纠错率飙升个案；基准无清晰下滑。企业若用 Opus 做长程 Agent，需加回归用例与人工验收，勿只看榜单。
Anthropic IPO 估值预期下修讨论：原谈约 1.25–1.75T / 募资 800–1000 亿，市场读数落到约 1.1–1.3T 区间
属舆情与二级预期，非招股书确认。可与本周 Verge/METR、路演窗口并读；以交易所披露为准。
扣子企业版停新售并分阶段下线：11-30 起停新客；旧套餐 12-31、新企业套餐最晚 2027-12-31 下线
官方公告：配合并入豆包体系的产品整合；过渡期权益与退款规则写明。企业若押宝独立 Coze SaaS，需规划迁到「豆包工作」/火山后续方案并导出工作流。
Multi-layer Indexer: Overlapping Selection and Attention in DeepSeek Sparse Attention
Overlap DSA indexer scan with attention via prior-layer selections; up to ~14.5% faster decode vs IndexCache on DeepSeek-V3.2.
From Autonomous Agents to Cognitive Symbionts: Toward AI-Augmented Human Intelligence
Perspective: score AI by how much a particular person can do; lifelong wearable coupling + governance.
NitroFusion2：把对抗损失接到多模态 DiT 的文本流，冲 1–2 步高质量生图
改进什么：少步扩散质量掉点。怎么做：文本流对抗蒸馏 + 宽高比条件判别。面向低延迟文生图管线。
LiveFoley：流式视频→音频，用拖尾滑窗对齐视觉、扩大时域去噪窗换保真
改进什么：实时交互世界里音画不同步。怎么做：trailing window + 扩大 temporal denoising。适合沉浸式/游戏 Foley 研究。
谷歌研究：普通智能表 PPG+运动即可筛高血压迹象——196 人试验检出约 65.8% vs 诊室袖带约 55.3%
无袖带校准；近 50 万小时传感器自监督学脉率模式后多日聚合。已进 Google Health「血压趋势」研究功能，非诊断替代。可穿戴健康 AI 落地样本。
Vals CyberOffense 再读：开源权重 DeepSeek V4.1 Flash 攻破模拟企业网约 72.8%，闭源 Daybreak 约 80.8%——价差约 7×
短测会低估开源（Flash 多在 >1 亿 token 后才起量）。AISI：开闭源网安能力差距缩到约 4–7 个月。企业红队/蓝队都要用长时程评测；权重公开后难「关闸」。主题此前有报道，本条跟 Decoder 11-07 综述。