A Claude Code configuration file titled “Don’t Ask Again” contains at least one secret in each of 1,122 public copies on GitHub, according to the security firm Apiiro. The finding is circulating as current news on The Hacker News, but it is not yet a settled story. This desk could not retrieve Apiiro’s full report, and the homepage snapshot says only “yesterday,” so the publication date remains unconfirmed.
The count describes exposure, not access. Apiiro says it did not test whether any of those secrets still work. A revoked key is an inconvenience. A live one can open the same doors it always could, and that single question decides how serious this is.
What Apiiro reported about the exposed Claude Code file
The core of the report is a count of public copies. Apiiro reports that 1,122 public copies of the “Don’t Ask Again” file contain at least one secret. The file is a Claude Code configuration file, and the sources available to this story do not establish whether it is created by default or through a common setting.
Several basic details are missing. The sources do not identify the types of secrets involved, and they do not explain how Apiiro found the files or verified that each copy held a credential. Without that method, the number is hard to compare with other exposure studies.
Developers have long committed local configuration to version control without reading it closely, and that habit is how a convenience file becomes a public credential. What makes this case different is the source. The file belongs to an AI coding tool that many developers now run alongside their production code, and it is spreading through public repositories that small teams often never scan.
How the October Cursor backdoor differs from the GitHub exposure
The two stories are easy to blur, and they should be kept apart. The October case was a compromised distribution channel. On October 29, 2026, a trojanized Claude Code extension for VS Code, versions 2.1.312 and 2.1.313, was available on Cursor’s marketplace for roughly 11 hours. It tried to install a persistent SSH backdoor, according to The Hacker News and CSO Online.
Cursor said at most 5,000 users were affected and that it removed the malicious builds, according to BankInfoSecurity. In a security notice quoted by CSO Online, the company wrote: “These malicious versions of the extension were not developed by Anthropic.”
The malicious build carried the legitimate extension ID, which is why it looked like the real product. Microsoft said in its security blog post that its own marketplace and Anthropic’s npm package were not affected.
The GitHub exposure is a different problem. It concerns secrets that people left inside files in public repositories, not a poisoned download. That puts the risk in how teams store credentials. USA 24 has already covered a separate Claude Code issue involving email addresses in request headers, and this development should be read as distinct from that one.
Which Claude Code versions are affected and which is safe
The October incident leaves developers with a clear version map. Anthropic issued version 2.1.314, which omits the malicious code, according to BankInfoSecurity.
| Version | Status |
|---|---|
| 2.1.312 | Malicious build that tried to install an SSH backdoor |
| 2.1.313 | Malicious build that tried to install an SSH backdoor |
| 2.1.314 | Fixed by Anthropic and omits the malicious code |
The window was short, but a short window does not guarantee a clean machine. Anyone who installed either malicious version should treat the host as potentially affected, even if the extension has since been removed or updated. Check the installed version in your editor’s extensions list before you assume anything.
How to check public GitHub repos for exposed Claude Code secrets
Start with your own code and work outward to forks and old projects. These steps apply to the Apiiro exposure and the October incident.
- Search your public repositories and their forks for a file named “Don’t Ask Again.” Include archived projects, because old copies stay public until someone removes them.
- Check every match for committed secrets, including API keys, tokens and passwords.
- Rotate every key you find, even if you believe it has expired. Apiiro has not said whether the secrets still work, so treat each one as live until it is revoked.
- Remove the secret from the file and from git history. Deleting the file in a new commit leaves the secret in earlier commits.
- Confirm that Claude Code for VS Code is version 2.1.314 or later.
- If you installed 2.1.312 or 2.1.313 from Cursor’s marketplace, move to the next section before you assume the machine is clean.
Small teams should assign one person to run this search on a schedule. Larger organizations can add a secrets scanner to their public repositories and forks, though no source in this story confirms which scanners detect this file.
Why reinstalling will not clear the Cursor backdoor
Researchers told Help Net Security that uninstalling the extension does not remove the backdoor, according to Help Net Security. That changes the response. Installing the fixed version is not enough, because the malicious code may already have set up persistence on the host.
For any machine that ran 2.1.312 or 2.1.313, the next step is an investigation rather than a reinstall. Review the authorized SSH keys on the machine and on any shared accounts, and remove keys you do not recognize. Look for unfamiliar startup items, scheduled tasks and background services. If you find signs of intrusion on a work machine, bring in your security team and rotate the credentials that were stored there.
What remains unconfirmed in the Apiiro report
Several facts are not yet established, and readers should weigh the GitHub count with that in mind.
- Apiiro’s full report was not retrieved for this story, so its method for finding files and secrets cannot be checked.
- The secret types involved are unknown, and Apiiro says it did not test whether any still work.
- The publication date is unknown, because the Hacker News snapshot says only “yesterday.”
- It is not established whether the file is generated by default or by a common setting.
- A secondary report on note.com says the disclosure of how the malicious build reached Cursor’s marketplace had not been made as of early November.
- This story has not obtained a response from Anthropic or GitHub.
Until Apiiro’s report and an independent confirmation are in hand, treat the 1,122 figure as a lead, not a settled count.
What to watch next for AI coding tool security
Three developments will decide how much this story matters. The first is Apiiro’s full report, which should show how the team found the copies and what kinds of secrets they held. The second is an independent confirmation, which would turn a single-source finding into a documented one. The third is whether Anthropic or GitHub changes warnings, defaults or scanning around this file.
The October incident raises a separate question for marketplace operators. A trojanized build carried a legitimate extension ID onto a store that developers trust, and the public explanation of how that happened has not yet been released. Pressure to explain that gap will likely grow if more AI tool incidents follow.
Small engineering teams carry the most risk here, since they rarely have anyone assigned to watch public repositories or extension stores. Treat configuration files and editor extensions with the same suspicion you give any third-party code, and rotate credentials on a schedule instead of after an alert.
