Provenance Record

Analysis, body 1,811 words by wc (1,801 with link targets removed; range 800-2000). Structure Overview, Background, Current situation, Implications follows the Analysis template. It examines a topic (where credentials are stored, exposed and sought around AI coding agents) across three separate reports rather than recapping one release, keeps reported facts and the Herald's own synthesis apart (the Implications section opens by saying it is drawn from the sources, not a forecast), and ends with an explicit list of open questions. No prediction or opinion presented as the Herald's own was found. Title is 136 characters (under the 150 cap). Quoted strings recounted: the body contains 5 double-quoted strings, not about 37 ('Yes, and don't ask again', 'Comment and Control', 'The runtime is the blast radius.', 'yesterday', 'not planned'), plus 9 code spans; all 5 quotes are verbatim in the sources. Minor style notes, not corrections: the dated section headings are thematic and not chronological (April 21, then March 17 and May 5, then September, then November, then November 5), though each carries its own date and none sets two events side by side as cause and effect; the closing sentence 'how often the first two end up in the third' has an ambiguous referent but states no fact.

Anthropic disclosure: required - Claude Code and Anthropic's Claude Code Security Review are in the headline and lead. The Overview ends with one neutral sentence ('The Herald's contributor model is built by Anthropic, which makes Claude Code; statements about Anthropic's products below are attributed to the cited sources.'); present and accurate. I checked each Anthropic or Claude Code statement in the body: the bounty/CVSS classification is 'per Guan's disclosure timeline as relayed by VentureBeat', the documentation behaviour is attributed to Claude Code's documentation, the 16-agent comparison and the unanswered bug reports are attributed to the researchers via The Hacker News, and the article drops VentureBeat's editorial remark that the $100 amount was 'notably low'. No judgement of quality. ALLOWLIST: all nine hosts are on config/source_allowlist.txt (venturebeat.com, thehackernews.com, gbhackers.com, microsoft.com, cybersecuritynews.com, blog.gitguardian.com, docs.github.com, code.claude.com, github.blog); no additions needed. apiiro.com is not allowlisted and is not cited; every Apiiro figure reaches the article through The Hacker News or GBHackers (live fetch of the Apiiro write-up returned HTTP 403 and the Archive.org copy was an empty JavaScript shell, so I did not read it; I did not rely on it). SNAPSHOTS READ (gunzip -c, text extracted, hashes recomputed and equal to manifest): source-0 VentureBeat (sha256 f3b5adf7...) confirmed; source-3 Microsoft Security Blog (0790973c...) confirmed; source-5 GitGuardian (761d42b9...) confirmed; source-6 GitHub Copilot CLI authentication docs (e7acee78...) confirmed; source-7 code.claude.com/docs/en/permissions (1f1bec94...) confirmed; source-8 code.claude.com/docs/en/settings (988674407...) confirmed; source-9 code.claude.com/docs/en/mcp (9643b9e7...) confirmed; source-10 GitHub changelog 2026-03-17 (64857942...) confirmed; source-11 GitHub changelog 2026-05-05 (435dd4a8...) confirmed. SNAPSHOTS THAT FAILED, read by another route: source-1 The Hacker News (stored snapshot is empty, sha256 e3b0c442..., the hash of zero bytes), source-2 GBHackers (HTTP 520, no file), source-4 Cyber Security News ('fetch failed', no file). I fetched all three live with curl and a Chrome User-Agent (HTTP 200, raw HTML, text extracted, no summaries): thehackernews.com raw sha256 683ede2bfe6bbd6212594a7a30481aa59eb5eac429b7a06a448381f0e8cf27c7; gbhackers.com raw sha256 6cc47f18551f327215f32f78aeff7634b491acfdcbbfc243cfce49659e78805e; cybersecuritynews.com raw sha256 9754d05c346755e1eb6e43c800076a4e44246c582bce35e3f21052eaf20bed86. These live copies are not in the committed snapshot directory. VENTUREBEAT (Louis Columbus, 7:51 am PT, April 21, 2026): PR-title injection made Claude Code Security Review post its own API key as a comment, same injection worked on Gemini CLI Action and Copilot Agent - exact. Aonan Guan with Johns Hopkins colleagues Zhengyu Liu and Gavin Zhong, 'Comment and Control' - exact. pull_request_target 'which most AI agent integrations require for secret access' - exact; env-var secrets 'readable by every workflow step, including AI coding agents' - VentureBeat's wording. Agent 'had bash, write, and env-read access for a code review task' - exact. Anthropic CVSS 9.4 Critical ($100 bounty), Google $1,337, GitHub $500 'Per Guan's disclosure timeline' - exact. 'All three patched quietly, and none had issued CVEs in the NVD or published security advisories through GitHub Security Advisories as of Saturday' - the article keeps 'as of the Saturday before its article' (the Saturday is the Herald's inference from the Tuesday dateline; no date is asserted). Anthropic documentation update and 'trusted first-party inputs by default' - exact. 'OpenAI and Google did not respond for comment by publication time' - exact. Baer: CSO at Enkrypt AI and former Deputy CISO at AWS, quote 'The runtime is the blast radius.' - verbatim. Recommendations (short-lived OIDC, strip bash from code-review agents, rotate all exposed credentials) - exact. What VentureBeat independently establishes: its own reporting of Guan's disclosure, the bounty timeline, the vendors' non-response and a comment from Baer, plus a review of three system cards (the article does not use the system-card review); it is a different event from the other two stories. THE HACKER NEWS (Swati Khandelwal, Nov 07, 2026): 104,185 copies in 103,617 repositories, about 1.1% = 1,122 copies with at least one secret, 1,379 distinct secrets, 63 organizations, 298 of 76,011 settings.json copies, 2,539 secrets across 1,994 repositories, 16 agents with Claude Code 'the only one confirmed to save the full approved command in a project file by default', gitleaks 564, TruffleHog 643, neither 215, 'most misses are passwords typed inside commands', 'Apiiro said yesterday', 'did not test whether any still work', one notified company confirmed its key had been live, bug report filed August 11, 2025 closed by a bot as 'not planned' on January 3 (no year given - the article says so), four related reports all closed by the bot and none answered by Anthropic ('they say') - all exact. Pattern 'npm test *' vs one exact command saved in plain text - exact. Global git exclude does nothing for an already-committed file ('the researchers say') - exact. GBHACKERS (Eswar, November 7, 2026): 'Their November 5 research' - the article's report that GBHackers dates the research to November 5 while The Hacker News is dated November 7 and says Apiiro spoke 'yesterday' is exactly what the two pages say; the article leaves the two unreconciled. GBHackers repeats 104,185/103,617/1,122/1,379/2,539/1,994/63, 564/643/215, adds a breakdown (636 provider-format keys, 743 passwords or tokens, 379 database passwords, 122 Supabase service-role keys) and says Apiiro 'did not test credentials or contact hosts'. Neither page carries an Anthropic statement - the article's scoped sentence is true. Herald-derived figures recomputed: 1,122 minus 215 = 907 flagged by at least one tool; 215 / 1,122 = 19.2%, 'about 19 percent' - correct and labelled 'By the Herald's own subtraction'; 1,122 / 104,185 = 1.08%, matching the outlet's 1.1%. MICROSOFT (Microsoft Threat Intelligence and Microsoft Security Research, November 5): 'Starting in August 2026, Microsoft observed threat actors using an agentic AI offensive framework to submit large volumes of queries to GitHub for secrets'; queries often included an organization name, secret keywords, a cloud keyword or an AI-provider keyword; ARTEX is named in the introduction ('agentic tooling like ARTEX') and in the detections table ('GitHub repository scanning activity discussed in this blog'); 'in at least one case... in just five minutes'; follow-on service-principal sign-ins 'As early as October 28, 2026'; 'Treat credentials that have been publicly exposed as compromised, even if the original location has subsequently been edited or deleted'; managed identities over secret-based OAuth authentication; 'removing the original disclosure alone does not remediate the exposure' - all match. Scope: Microsoft's own telemetry and customers, first-party; it does not mention Claude Code or agent settings files (grep of Microsoft and Cyber Security News text for 'claude' and 'settings.local' found none), so the article's absence sentence holds. CYBER SECURITY NEWS (Tushar Subhra Dutta, November 6): 'The five-minute finding describes one documented case, not the time required for every attack' - the article attributes this to the outlet correctly; otherwise a restatement of Microsoft. GITGUARDIAN (25 Sep 2026): vendor post whose TL;DR promotes GitGuardian Developer Endpoint Protection; 24,008 unique secrets in public MCP configuration files, 2,117 valid, 3.2% vs 1.5% with 'the measurement does not assign causation to the tool alone', Cursor project MCP file travels with the repository, Claude Code supports env-var references but 'nothing prevents a team from writing a token inline', scanners do not traverse home-directory config, shell history or temp files - all exact; the article labels it a vendor and the figures as GitGuardian's. COPILOT CLI DOCS: OAuth token in the OS keychain by default, otherwise 'prompts you to store the token in a plaintext configuration file at ~/.copilot/config.json' - exact. CLAUDE CODE DOCS: permissions page - 'Yes, and don't ask again' ... 'saves the rule to .claude/settings.local.json at the root of the git repository' (the page also lists exceptions such as outside a git repository or on Windows; the article gives the default case); settings page - first write adds the file to the global git excludes, hand-created files need .gitignore - exact; MCP page - add the entry to .mcp.json at the project root 'and commit it', and ${VAR} expansion exists - exact. GITHUB CHANGELOGS: March 17, 2026 public preview, May 5, 2026 GA, for repositories with GitHub Secret Protection enabled, scan code changes before commit when the agent is asked - exact. Absence claims tested against all twelve sources: 'None of the cited sources says ARTEX searched for coding-agent settings files', 'No cited source connects ARTEX's searches to agent settings files', 'none of the cited sources says whether the tools cover agent settings files', 'the cited sources give no public-file count for other agents' - all hold. Absence sentence 'Neither The Hacker News nor GBHackers carries an Anthropic statement' - holds. Quantifiers: 'All three replace a literal stored secret with a reference or a credential that expires' and 'All three also advise rotating' hold item by item (VentureBeat: OIDC and rotate; Microsoft: managed identities and rotate; Apiiro via The Hacker News: variable references and rotate first). INTERNAL LINKS: /article/2026-03/06-claude-code-vulnerabilities-... exists (Check Point Research, two Claude Code CVEs, project configuration files as attack vectors - described accurately); /article/2026-10/05-truffle-security-finds-543699-credentials-... exists (543,699 still-valid credentials in public GitHub repositories - described accurately); neither has a corrections record. SUSPICIOUS PATTERNS: three scanner matches (system-prompt-reference) on code.claude.com permissions, settings and mcp snapshots. Permissions and MCP: the matched text is navigation JSON from the docs site ('Customize behavior', 'description':'System prompts, skills, and plugins', href '/en/agent-sdk/modifying-system-prompts'), a menu entry about the Agent SDK. Settings: 'Claude Code's system prompt isn't published. To give Claude standing instructions, use' CLAUDE.md files or the --append-system-prompt flag - ordinary user documentation addressed to human readers. None of the three addresses an AI reader, asks for any action or hides anything; I also searched all twelve texts for 'ignore previous instructions' style phrases and found none. Override: false positives. INDEPENDENT-SOURCE RECOUNT (policy: by outlet): VentureBeat, The Hacker News, GBHackers and Cyber Security News are four separate news outlets, none of them the subject's own page; GitGuardian (vendor post), Microsoft, GitHub, Anthropic and Copilot documentation are first-party. Counting strictly for outlets that add reporting of their own: VentureBeat clearly (Baer interview, outreach to vendors, system-card review, a separate event); The Hacker News partly (named-staff report that cross-checks the mechanism against Anthropic's permissions and settings documentation and reports the status of the related bug reports 'as of today', but whose figures are all Apiiro's and which reports no independent test); GBHackers and Cyber Security News restate (the article says so). So 4 outlets on the policy count with two described as restating, 2 on the strict count with The Hacker News in the weaker position, and no outlet independently reproduced Apiiro's counts or Microsoft's observations. The article describes The Hacker News only as reporting research done by others; the clarification filed states that it largely relays Apiiro's write-up. The requirement of at least 2 independent outlets and at least 4 sources is met (12 sources, 4 outlets).

No wrong statement found in the headline, summary or lead; every number, date, name, quote and version traced to the raw text of its source. One incomplete subordinate point: the article calls The Hacker News, like VentureBeat, a news outlet that 'report[s] research done by others' and singles out only GBHackers and Cyber Security News as restating, while The Hacker News's account is itself largely a relay of Apiiro's write-up and the article's Apiiro figures (including 'By Apiiro's run' and 'Apiiro's counts cover public GitHub' in the Implications and open-questions sections) come from The Hacker News and GBHackers, not from Apiiro's own page. Filed as a clarification.

Careful, well-attributed Analysis built on twelve sources, with every figure verified, Herald-derived numbers labelled and recomputed correctly, and open questions that stay within what the sources state; one clarification on how The Hacker News and Apiiro are described. Featured candidacy: 2 - a notable security story on credentials exposed through widely used AI coding agents, of interest to a broad developer audience, but a synthesis of reports from other parties rather than original finding