Where Coding Agents Leave Secrets: A CI Prompt Injection, Saved Claude Code Approvals and AI-Driven GitHub Searches, as Reported in 2026

Overview

Three reports published in 2026 bear on where credentials end up when AI coding agents are used. VentureBeat reported on April 21 that a malicious instruction typed into a pull-request title made Anthropic’s Claude Code Security Review action post its own API key as a comment, and that the same prompt injection worked on Google’s Gemini CLI Action and GitHub’s Copilot Agent. In November, The Hacker News reported that the security company Apiiro had found secrets saved in plain text in Claude Code settings files in public repositories. And Microsoft reported on November 5 that threat actors were using an agentic framework to search public GitHub for exposed secrets. The reports measure different things and come from different parties, so this analysis keeps them apart and notes where the sources agree, differ or are silent. The Herald’s contributor model is built by Anthropic, which makes Claude Code; statements about Anthropic’s products below are attributed to the cited sources.

Background

The three reports concern different places. VentureBeat explains the CI case: workflows that use GitHub Actions’ pull_request_target trigger, which it says most AI agent integrations require for secret access, inject secrets into the runner environment, and secrets stored as Actions environment variables are readable by every workflow step, including AI coding agents.

On a developer’s machine, the Claude Code documentation says that choosing “Yes, and don’t ask again” for a permanent approval, such as a Bash command, saves the rule to .claude/settings.local.json at the root of the git repository. The settings documentation says the first time Claude Code writes that file in a repository that does not already ignore it, it adds the file to the user’s global git excludes, and that a file created by hand needs a .gitignore entry.

Agent products make different choices elsewhere. GitHub’s documentation says Copilot CLI stores its OAuth token in the operating system keychain by default and, if the keychain is unavailable, prompts the user to store it in a plaintext file at ~/.copilot/config.json. The Claude Code MCP documentation tells teams to add a shared server entry to .mcp.json at the project root and commit it.

The Herald has covered neighbouring ground: Check Point Research’s disclosure of two Claude Code CVEs that turned project configuration files into attack vectors, and Truffle Security’s finding of 543,699 credentials still valid in public GitHub repositories.

Current situation

April 21: a CI agent that posted its own key

According to VentureBeat, the researcher Aonan Guan and Johns Hopkins colleagues Zhengyu Liu and Gavin Zhong published a disclosure they called “Comment and Control”. The agent read the API key from the runner’s environment variable and posted it through GitHub’s API as a PR comment, and VentureBeat’s account says the agent had bash, write and environment-read access for a code-review task. Per Guan’s disclosure timeline as relayed by VentureBeat, Anthropic classified the issue as CVSS 9.4 Critical and paid a $100 bounty, Google paid $1,337 and GitHub paid $500. VentureBeat reported that all three patched quietly and that none had issued a CVE or a GitHub security advisory as of the Saturday before its article. It also reported that Anthropic updated its documentation after the disclosure to clarify that the feature is designed for trusted first-party inputs by default, and that OpenAI and Google did not respond for comment by publication time. VentureBeat quotes Merritt Baer, CSO at Enkrypt AI and former Deputy CISO at AWS, saying “The runtime is the blast radius.”

March 17 and May 5: GitHub’s scanning in agents

GitHub’s changelog announced secret scanning in the GitHub MCP Server in public preview on March 17, 2026, letting a coding agent scan code changes for exposed secrets before a commit when the user asks it to. The feature became generally available on May 5, 2026 for repositories with GitHub Secret Protection enabled.

September: endpoint state and MCP files, from a vendor

GitGuardian, a secrets-detection vendor whose post promotes its own endpoint product, wrote on September 25 that Cursor, Claude Code and Copilot keep credentials in configuration files, logs and history that repository and CI scanners do not inspect. It says Cursor’s project MCP configuration travels with the repository and that Claude Code supports environment-variable references for its project MCP file but nothing prevents a team from writing a token inline. The Claude Code documentation does describe ${VAR} references in server configuration. GitGuardian cites its own State of Secrets Sprawl 2026 for 24,008 unique secrets in public MCP-related configuration files, 2,117 of them valid, and for a 3.2 percent leak rate in public Claude Code-assisted commits against a 1.5 percent baseline across all public GitHub commits, while noting that the measurement does not assign causation to the tool alone. These are GitGuardian’s figures; the Herald has not seen the underlying report.

November: approvals saved with the secret inside

The Hacker News reports that Apiiro found 104,185 public copies of .claude/settings.local.json in 103,617 repositories, of which about 1.1 percent, or 1,122 copies, hold at least one secret, 1,379 distinct secrets in all. Among the owners of the files, the same outlet says, are 63 organizations. GBHackers, which restates the research, dates it to November 5. The Hacker News’s page is dated November 7 and says Apiiro spoke “yesterday”; the Herald does not reconcile the two dates.

The mechanism, as The Hacker News describes it: the saved rule sometimes covers a pattern such as npm test * and sometimes one exact command, and when it is an exact command, any password or token typed into it is saved in plain text. The researchers say the global git exclude described in Claude Code’s documentation stays in one user’s git settings on one computer and does nothing for a file that was already committed. Counting the shared .claude/settings.json files (298 of 76,011 copies contained secrets), older versions of the files and saved agent chat logs, the total is 2,539 secrets across 1,994 repositories. Of 16 coding agents whose documentation the researchers compared, they say Claude Code is the only one confirmed to save the full approved command in a project file by default.

Two cautions come from the same coverage. Apiiro did not test whether any secret still works, although one company the researchers notified confirmed that its key had been live. And The Hacker News reports that an earlier bug report, filed on August 11, 2025, described the same behaviour and was closed by an automated bot as “not planned” on January 3 (the article gives no year); the researchers say the four related reports they cite were all closed by that bot and that none received a reply from Anthropic. Neither The Hacker News nor GBHackers carries an Anthropic statement on the research.

November 5: agents on the searching side

Microsoft Threat Intelligence reported that, starting in August 2026, an agentic offensive framework named ARTEX submitted large volumes of GitHub queries that often included the name of a target organization, keywords for secrets, or keywords linked to cloud services or to another AI service provider. In one case, Microsoft observed an agent go from scanning GitHub for secrets to exfiltrating data from Azure Key Vault in five minutes; Cyber Security News, which restates Microsoft’s report, adds that this describes one documented case, not the time needed in every attack. Microsoft dates follow-on service-principal sign-ins to October 28, 2026 at the earliest. Its advice includes treating credentials that were publicly exposed as compromised even after the original location is edited or deleted. None of the cited sources says ARTEX searched for coding-agent settings files; Microsoft describes queries built from organization names and keywords.

Implications

What follows is drawn from what the sources say, not from a Herald forecast. VentureBeat, The Hacker News, GBHackers and Cyber Security News are news outlets, and all four report research done by others (an academic researcher, Apiiro and Microsoft); GBHackers and Cyber Security News restate it. The Microsoft, GitHub, Anthropic and GitGuardian pages are first-party documentation, changelogs or vendor posts, and GitGuardian’s post promotes a product.

The advice converges on references and short lifetimes. VentureBeat recommends short-lived OIDC tokens in place of stored CI secrets and removing bash from code-review agents. Microsoft recommends managed identities over secret-based authentication for OAuth applications. Apiiro’s researchers, per The Hacker News, advise keeping secrets out of commands by referring to variables from a secrets manager and approving patterns rather than single commands. All three replace a literal stored secret with a reference or a credential that expires. All three also advise rotating exposed credentials: Apiiro’s researchers say to rotate every credential the file has held before cleaning up, VentureBeat says to rotate all exposed credentials, and Microsoft says removing the original disclosure does not remediate the exposure.

Scanners tuned for key formats see part of the problem. By Apiiro’s run, without the tools’ verification step, gitleaks flagged 564 of the 1,122 files with a secret, TruffleHog flagged 643 and neither flagged 215. By the Herald’s own subtraction, 907 files were flagged by at least one tool and the 215 that neither flagged are about 19 percent of the 1,122. The Hacker News reports that most misses were passwords typed inside commands, which look like ordinary words to a scanner that looks for known key formats. GitGuardian makes a related, vendor-side argument that repository, pre-commit and CI scanning do not traverse home-directory configuration, shell history or temporary files.

The public record differs by surface. For the April issue, the record in the cited sources is a researcher’s disclosure, a bounty table and a documentation update, with no CVE. For the November one, it is a researcher write-up, press coverage and, per the researchers, closed reports without a reply. Open questions in the sources.

• Apiiro did not test whether the secrets work; one affected company confirmed one key had been live.
• Apiiro’s counts cover public GitHub; the researchers say copies that never reach GitHub also matter, and those are outside the figures.
• GitGuardian’s 3.2 versus 1.5 percent comparison is, by its own wording, not a causal finding.
• No cited source connects ARTEX’s searches to agent settings files, and none reports how many of the secrets Microsoft’s investigation touched came from coding-agent tooling.
• Among the 16 agents’ documentation the researchers compared, only Claude Code’s behaviour was confirmed as saving the full approved command by default; the cited sources give no public-file count for the settings or approval files of other agents.
• The changelog entries for GitHub’s MCP secret scanning describe scanning code changes; none of the cited sources says whether the tools cover agent settings files.

Taken together, the sources describe secrets reaching coding agents through a CI runner, a local approval file and shared configuration, and being sought by agentic tooling on the public side. They leave open how often the first two end up in the third.