# Claude Code Config File Exposes Secrets in 1,122 Public GitHub Copies

- URL: https://usa-24.com/claude-code-secrets-github/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-11-07T19:25:23.466Z
- Updated: 2026-11-07T19:25:23.474Z
- Topics: AI Coding Tools, GitHub Security, Developer Security, Supply Chain Attacks, Cybersecurity

> Apiiro says 1,122 public GitHub copies of a Claude Code configuration file contain at least one secret. The finding is unverified, and the October Cursor backdoor makes it urgent to check.

## Key takeaways

- Apiiro reports that 1,122 public GitHub copies of a Claude Code file titled “Don’t Ask Again” each contain at least one secret.
- Apiiro did not test whether any of the exposed secrets still work, so rotating every key you find is the safe response.
- Malicious Claude Code for VS Code builds 2.1.312 and 2.1.313 sat on Cursor’s marketplace for about 11 hours on October 29, 2026.
- Anthropic’s fixed version is 2.1.314, and Cursor said at most 5,000 users were affected by the trojanized builds.
- Researchers said uninstalling the malicious extension does not remove the SSH backdoor, so affected hosts need a persistence check.

A Claude Code configuration file titled “Don’t Ask Again” contains at least one secret in each of 1,122 public copies on GitHub, according to the security firm Apiiro. The finding is circulating as current news on [The Hacker News](https://thehackernews.com/), but it is not yet a settled story. This desk could not retrieve Apiiro’s full report, and the homepage snapshot says only “yesterday,” so the publication date remains unconfirmed.

The count describes exposure, not access. Apiiro says it did not test whether any of those secrets still work. A revoked key is an inconvenience. A live one can open the same doors it always could, and that single question decides how serious this is.

## What Apiiro reported about the exposed Claude Code file

The core of the report is a count of public copies. Apiiro reports that 1,122 public copies of the “Don’t Ask Again” file contain at least one secret. The file is a Claude Code configuration file, and the sources available to this story do not establish whether it is created by default or through a common setting.

Several basic details are missing. The sources do not identify the types of secrets involved, and they do not explain how Apiiro found the files or verified that each copy held a credential. Without that method, the number is hard to compare with other exposure studies.

Developers have long committed local configuration to version control without reading it closely, and that habit is how a convenience file becomes a public credential. What makes this case different is the source. The file belongs to an AI coding tool that many developers now run alongside their production code, and it is spreading through public repositories that small teams often never scan.

## How the October Cursor backdoor differs from the GitHub exposure

The two stories are easy to blur, and they should be kept apart. The October case was a compromised distribution channel. On October 29, 2026, a trojanized Claude Code extension for VS Code, versions 2.1.312 and 2.1.313, was available on Cursor’s marketplace for roughly 11 hours. It tried to install a persistent SSH backdoor, according to [The Hacker News](https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html) and [CSO Online](https://www.csoonline.com/article/4243210/cursor-removes-malicious-claude-code-extension-after-ssh-backdoor-attempt.html).

Cursor said at most 5,000 users were affected and that it removed the malicious builds, according to [BankInfoSecurity](https://www.bankinfosecurity.com/cursor-confirms-anthropic-claude-code-extension-compromised-a-33263). In a security notice quoted by CSO Online, the company wrote: “These malicious versions of the extension were not developed by Anthropic.”

The malicious build carried the legitimate extension ID, which is why it looked like the real product. Microsoft said in its [security blog post](https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/) that its own marketplace and Anthropic’s npm package were not affected.

The GitHub exposure is a different problem. It concerns secrets that people left inside files in public repositories, not a poisoned download. That puts the risk in how teams store credentials. USA 24 has already covered a separate Claude Code issue involving email addresses in request headers, and this development should be read as distinct from that one.

## Which Claude Code versions are affected and which is safe

The October incident leaves developers with a clear version map. Anthropic issued version 2.1.314, which omits the malicious code, according to [BankInfoSecurity](https://www.bankinfosecurity.com/cursor-confirms-anthropic-claude-code-extension-compromised-a-33263).

| Version | Status |
|---|---|
| 2.1.312 | Malicious build that tried to install an SSH backdoor |
| 2.1.313 | Malicious build that tried to install an SSH backdoor |
| 2.1.314 | Fixed by Anthropic and omits the malicious code |

The window was short, but a short window does not guarantee a clean machine. Anyone who installed either malicious version should treat the host as potentially affected, even if the extension has since been removed or updated. Check the installed version in your editor’s extensions list before you assume anything.

## How to check public GitHub repos for exposed Claude Code secrets

Start with your own code and work outward to forks and old projects. These steps apply to the Apiiro exposure and the October incident.

- Search your public repositories and their forks for a file named “Don’t Ask Again.” Include archived projects, because old copies stay public until someone removes them.
- Check every match for committed secrets, including API keys, tokens and passwords.
- Rotate every key you find, even if you believe it has expired. Apiiro has not said whether the secrets still work, so treat each one as live until it is revoked.
- Remove the secret from the file and from git history. Deleting the file in a new commit leaves the secret in earlier commits.
- Confirm that Claude Code for VS Code is version 2.1.314 or later.
- If you installed 2.1.312 or 2.1.313 from Cursor’s marketplace, move to the next section before you assume the machine is clean.

Small teams should assign one person to run this search on a schedule. Larger organizations can add a secrets scanner to their public repositories and forks, though no source in this story confirms which scanners detect this file.

## Why reinstalling will not clear the Cursor backdoor

Researchers told Help Net Security that uninstalling the extension does not remove the backdoor, according to [Help Net Security](https://www.helpnetsecurity.com/2026/10/30/claude-code-extension-ssh-backdoor/). That changes the response. Installing the fixed version is not enough, because the malicious code may already have set up persistence on the host.

For any machine that ran 2.1.312 or 2.1.313, the next step is an investigation rather than a reinstall. Review the authorized SSH keys on the machine and on any shared accounts, and remove keys you do not recognize. Look for unfamiliar startup items, scheduled tasks and background services. If you find signs of intrusion on a work machine, bring in your security team and rotate the credentials that were stored there.

## What remains unconfirmed in the Apiiro report

Several facts are not yet established, and readers should weigh the GitHub count with that in mind.

- Apiiro’s full report was not retrieved for this story, so its method for finding files and secrets cannot be checked.
- The secret types involved are unknown, and Apiiro says it did not test whether any still work.
- The publication date is unknown, because the Hacker News snapshot says only “yesterday.”
- It is not established whether the file is generated by default or by a common setting.
- A secondary report on [note.com](https://note.com/ryohonma/n/nf47a3944b2d8?hl=en) says the disclosure of how the malicious build reached Cursor’s marketplace had not been made as of early November.
- This story has not obtained a response from Anthropic or GitHub.

Until Apiiro’s report and an independent confirmation are in hand, treat the 1,122 figure as a lead, not a settled count.

## What to watch next for AI coding tool security

Three developments will decide how much this story matters. The first is Apiiro’s full report, which should show how the team found the copies and what kinds of secrets they held. The second is an independent confirmation, which would turn a single-source finding into a documented one. The third is whether Anthropic or GitHub changes warnings, defaults or scanning around this file.

The October incident raises a separate question for marketplace operators. A trojanized build carried a legitimate extension ID onto a store that developers trust, and the public explanation of how that happened has not yet been released. Pressure to explain that gap will likely grow if more AI tool incidents follow.

Small engineering teams carry the most risk here, since they rarely have anyone assigned to watch public repositories or extension stores. Treat configuration files and editor extensions with the same suspicion you give any third-party code, and rotate credentials on a schedule instead of after an alert.

## Frequently asked questions

### Is the Claude Code secrets exposure on GitHub confirmed?

Not fully. The finding comes from the security firm Apiiro and appears on The Hacker News, but this story could not retrieve Apiiro’s full report. Apiiro says 1,122 public copies of a file titled “Don’t Ask Again” each contain at least one secret, so treat that count as a lead until independent confirmation appears.

### What should I do if I find a Claude Code secret in a public repository?

Rotate the credential first, even if you think it has expired, because Apiiro did not test whether the exposed secrets still work. Then remove the secret from the file and from git history. Check forks and archived projects for other copies.

### Which Claude Code extension version is safe to use?

Anthropic issued version 2.1.314, which omits the malicious code. Versions 2.1.312 and 2.1.313 were the malicious builds that sat on Cursor’s marketplace for about 11 hours on October 29, 2026. Check the installed version in your editor’s extensions list.

### Does reinstalling the extension remove the SSH backdoor?

No. Researchers said uninstalling the extension does not remove the backdoor. If you installed 2.1.312 or 2.1.313, check the affected host for persistence and unexpected SSH keys before you consider it clean.

### Is this the same as the Claude Code email address issue?

No. The October incident involved a compromised extension distributed through Cursor’s marketplace, and the GitHub exposure involves secrets left in public files. USA 24 has covered the separate issue involving email addresses in request headers.

## Sources

1. [The Hacker News (homepage)](https://thehackernews.com/)
2. [Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor, The Hacker News](https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html)
3. [Cursor removes malicious Claude Code extension after SSH backdoor attempt, CSO Online](https://www.csoonline.com/article/4243210/cursor-removes-malicious-claude-code-extension-after-ssh-backdoor-attempt.html)
4. [Cursor Confirms Anthropic Claude Code Extension Compromised, BankInfoSecurity](https://www.bankinfosecurity.com/cursor-confirms-anthropic-claude-code-extension-compromised-a-33263)
5. [Claude Code extension poisoned with persistent SSH backdoor, Help Net Security](https://www.helpnetsecurity.com/2026/10/30/claude-code-extension-ssh-backdoor/)
6. [Inside a malicious Claude Code-branded extension and its persistent SSH backdoor, Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/)
7. [Is That Extension Real: The Cursor Compromised Claude Code Extension Incident and How to Install AI Extensions, note.com](https://note.com/ryohonma/n/nf47a3944b2d8?hl=en)