- Towards AGI
- Posts
- Your AI Coding Agent Wrote Your Passwords Down. GitHub Kept Them.
Your AI Coding Agent Wrote Your Passwords Down. GitHub Kept Them.
here's what your agents are leaving behind
Today, we're diving into:
Gen AI: Claude Code's "don't ask again" button left 1,379 secrets sitting in public GitHub repositories, and common scanners missed some of them
Hot Tea: Microchip says AI buyers took over outside chip factories, stretching some lead times from 8 weeks to 32
AI news: Meta and Anthropic shipped new models on the same day, with an 80x gap in output price
Your AI Coding Agent Wrote Your Passwords Down. GitHub Kept Them.
Every time a developer clicks "Yes, and don't ask again" on a Claude Code shell prompt, the tool saves an approval rule in a small project file called .claude/settings.local.json. If the approved command contained a password, the password goes into that file in plain text, The Hacker News reported on November 7, citing new research from security firm Apiiro.
Then the file gets committed. The researchers found 104,185 copies of it in public GitHub repositories, and 1,122 of them held at least one secret.
Your Agents Create Data Nobody Catalogs.
Find out whether you can see every file, rule and record your AI tools leave behind.
What The Researchers Actually Found
The problem is not pattern rules like "allow npm test". It is the exact, word-for-word command a developer approved once, with the database password or token typed right into it.
Claude Code does add the file to the user's own global git excludes. That protects one laptop. It does nothing for the project's shared settings, or for copies already committed.
1,379 distinct secrets sat in the 1,122 exposed files.
379 were database passwords, plus 43 SSH logins, 42 GitHub, GitLab and npm tokens, and 23 AWS keys.
63 organizations owned the files, including an admin-level cloud key and a medical-records database password.
In half the repositories, the secret had been sitting on the default branch for at least 217 days.
In 539 of the traced repositories, the commit that changed the file listed Claude as a co-author. The researchers read that as the agent often committing its own settings file.
Of 16 coding agents compared, Claude Code was the only one confirmed to save the full approved command in a project file by default.
Your Scanners Probably Missed Some
The researchers ran two popular secret scanners, gitleaks and TruffleHog, over all 1,122 files. Neither tool flagged 215 of them.
Most of the misses were passwords tucked inside commands, such as a database login typed straight into the command line.
That matters because your secret-scanning program was built for a world where secrets live in .env files and config templates. Agents now write their own files, in their own folders, in their own formats.
This Is Not A Developer Problem. It Is A Visibility Problem.
The easy reaction is to blame careless engineers. They clicked a button that promised to save them time, exactly as designed.
The real issue is that every AI agent you deploy now produces a new class of data: approvals, memories, chat logs, settings. Most enterprises have no inventory of it, no owner for it and no policy for where it may go.
Deleting the file today does not undo the leak, because older versions stay in git history and in forks.
The wrong reaction is to ban coding agents. Your developers will simply use them somewhere you cannot see.
The better alternative is to treat agent folders like .claude/, .cursor/ and .gemini/ the way you already treat .env files: secret-bearing by default, scanned in every commit and blocked from shared repositories.
What You Should Do This Week
Search your GitHub organization for agent settings files, including git history and forks.
Rotate first, clean up second. Any password or key that ever sat in one of these files should be treated as exposed.
Keep secrets out of commands. Pull them from a secrets manager through variables, and approve patterns rather than single commands.
Teach your scanners new tricks. Make sure they catch passwords embedded inside command lines, not just tokens with known formats.
Seeing what your agents create starts with trusted enterprise context. DataManagement.AI helps organizations create that foundation by unifying metadata, lineage, governance, business glossaries and knowledge assets into a single intelligence layer. It automatically discovers metadata, maps lineage across the modern data stack and identifies downstream dependencies, so the data your agents produce has an owner and a policy before it lands somewhere public.
The organizations moving first will not just give developers faster agents. They will know exactly what those agents wrote down, and where it went.
AI Buyers Just Took Over The Chip Factory. Your Other Parts Are Waiting.
Microchip Technology beat its own sales forecast last week. Its stock still fell 10% the next day, 24/7 Wall St. reported on November 7.
The reason was what CEO Steve Sanghi said about capacity. Data center buyers, he said, "came in and took over the whole factory. They pushed everybody out."
Where The Squeeze Is Happening
AI demand is not only eating leading-edge chips. It is eating the packaging and test lines that ordinary chips need too.
According to the report, data center buyers have taken packaging and test lines at outside assembly and test houses. Some substrates are unavailable, and trailing-edge capacity is tight.
The result shows up in lead times. Microchip's standard products used to ship in four to eight weeks. Now it is six to 32 weeks, and moving the work elsewhere takes about six months.
Prices Are Next
Sanghi also expects most major foundries and assembly houses to raise prices again around January. Microchip plans to absorb the increases for now.
His most telling line was about AI itself: "some deceleration of the AI demand actually would be quite positive early on."
Why This Lands On Your Roadmap
Most leaders think of AI supply risk as a GPU problem. That is too narrow.
The chips Microchip sells go into factory equipment, vehicles, medical devices and the edge hardware many of your AI projects depend on. When AI buyers crowd the shared assembly lines, everything else waits in the queue.
The real bottleneck is not your AI budget. It is the physical supply chain that every one of your products and devices shares with the hyperscalers.
What You Should Do Now
Map your silicon exposure. Ask procurement which of your products and edge AI projects rely on standard microcontrollers and analog parts.
Re-check lead times. Any plan built on an eight-week assumption may now be a 32-week plan.
Budget for January. Price increases from foundries and assembly houses may reach you through your suppliers next year.
The organizations moving first will not just secure compute. They will secure the ordinary parts everyone else forgot were on the same production line.
Meta And Anthropic Shipped New AI Models On The Same Day. One Costs 80x More.
On November 9, two very different bets on enterprise AI arrived within hours of each other.
Meta released Muse Ember, a low-cost model priced at $0.10 per million input tokens and $0.50 per million output tokens. Anthropic released Claude Fable 5.2 at $8 per million input tokens and $40 per million output tokens.
Two Ends Of The Same Market
"Muse Ember delivers more intelligence per dollar than Claude Haiku 5.5 or GPT-6 Luna at any reasoning setting." Meta
Meta is pitching efficiency. On Artificial Analysis's AutomationBench, it reports Muse Ember at 37.8%, against 13.9% for Claude Haiku 5.5 and 20.2% for GPT-6 Luna. It is available through Meta's Model API, Google Cloud and Oracle Cloud.
Anthropic is pitching the top end. It reports Fable 5.2 at 69.9% on FrontierSWE v2, ahead of Opus 5.5 and GPT-6 Astra, and says the model is available across AWS, Google Cloud and Microsoft Azure.
Benchmarks Are Not Your Workload
Both sets of numbers come from the vendors' own pages, and each company picks the tests it presents. Even Meta's table shows Haiku 5.5 ahead of Muse Ember on one coding benchmark.
The Wrong Reaction Is Picking One Model
Many enterprises still standardize on a single model for everything. With an 80x gap in output price between these two releases, that choice now decides your AI bill more than any discount you negotiate.
The better alternative is routing. Send routine extraction, triage and summarization to the cheap tier, and reserve the frontier model for the work where its extra accuracy actually changes the outcome.
Measure on your own cases. Test both tiers on a sample of real tasks, not public leaderboards.
Price the whole task. A cheap model that needs three retries may cost more than an expensive one that gets it right once.
Keep switching cheap. Build your agents so a model change is a configuration change, not a rewrite.
Know Your Inference (KYI) is built for exactly this. When you measure how accurate, fast and costly each AI workload is on your own data, you can decide which model earns its price instead of guessing from a vendor chart.
This fundamentally changes how you budget for AI. The question is no longer which model is best. It is which model is best for each job.
The organizations moving first will not just buy the smartest model. They will know exactly which work deserves it, and pay a fraction for everything else.
Journey Towards AGI
Research and advisory firm guiding on the journey to Artificial General Intelligence
Know Your Inference Maximising GenAI impact on performance and Efficiency. | Model Context Protocol Connect with us, and get end-to-end guidance on AI implementation. |
Your opinion matters!
Hope you loved reading our piece of newsletter as much as we had fun writing it.
Share your experience and feedback with us below 'cause we take your critique very critically.
How's your experience? |
Thank you for reading
-Shen & Towards AGI team