Claude Code security risks: one week, two leaks. Stealers take the login, GitHub keeps the passwords.

01 Infostealers now take the agent’s login

WardenStealer is written in Rust and sold as a service to whoever pays. Aoki, written in Go, first showed up in SpyCloud’s data on 4 October and files its AI loot in a category of its own. SpyCloud saw data from ChatGPT, Claude Code, Claude Desktop, Codex, GitHub Copilot and Cursor [ Cyber Security News, 4 Nov ] .

From Claude Code, SpyCloud recovered the OAuth credentials file with the account’s access and refresh tokens, plus tokens for every connected MCP server. The stealers also took the account configuration file, with user and machine identifiers, and CLAUDE.md, the instruction file that often describes how a team’s systems fit together. From Codex they took the authentication file: an OpenAI API key with access and refresh tokens [ SpyCloud ] .

Anthropic’s own documentation explains why this works on Windows. There, Claude Code keeps its login in %USERPROFILE%\.claude\.credentials.json, protected only by the user account’s file permissions. Linux uses ~/.claude/.credentials.json. On macOS the login goes into the Keychain [ Anthropic docs ] . Malware running as the developer reads what the developer reads.

SpyCloud also found a market waiting for the output. Storefronts sold AI access at 40% to 91% below official prices. One listed a month of Codex API access with $100 of credit for $8.94. SpyCloud is careful to add that it cannot prove every advertised credential came from malware [ Cyber Security News ] .

02 Why a password reset does not end it

The usual response to a stolen password is to reset it and move on. Tokens break that habit. A refresh token exists so the agent can stay logged in without asking for a password again. Whoever holds it gets the same courtesy.

SpyCloud puts it plainly: with stolen AI tokens and session cookies, “much of that access survives both the password reset and the multi-factor prompt that would stop a reused credential” [ SpyCloud ] . How long the access lasts depends on the provider, the token type and the account’s controls. The safe assumption is that it lasts until someone revokes it.

For an MSP the stakes multiply. One technician’s machine can hold agent sessions and MCP connections for several client environments at once. Rotating the technician’s password protects none of them.

03 The file “don’t ask again” writes

Claude Code asks before it runs a shell command. Choose “Yes, and don’t ask again” and it saves the approval as an allow rule in .claude/settings.local.json at the root of the repository [ Anthropic docs ] . The rule is the exact command string. If the developer approved PGPASSWORD=… psql -h db.example.com, the password now sits in a JSON file in plain text.

Between 1 and 3 November, Apiiro searched public GitHub for that file. It found 104,185 copies in 103,617 repositories. 1,122 of them, about 1.1%, held at least one real secret [ Apiiro ] . Counting file history, the shared .claude/settings.json and committed agent transcripts, the total rose to 2,539 distinct secrets across 1,994 repositories [ GBHackers, 7 Nov ] .

One caveat matters. Apiiro did not test any credential or contact any host. “Real” means the value matches a provider’s key format or points at a public host. One affected company did confirm its exposed key had been live [ Developers Digest ] .

Claude Code does try to keep the file out of git. On first write it adds **/.claude/settings.local.json to the developer’s global git excludes [ Anthropic docs ] . That setting lives on one laptop. Apiiro points out that it does not follow the project to a fresh clone on another machine, a file created by hand, or a file already committed. Deleting the file later does not help either: the 734 secrets in the table survive only in history and forks [ Apiiro ] .

This is the second time this year. In April, Check Point researchers found the same file inside 428 of about 46,500 npm packages they monitored, with credentials in 33 of them [ SecurityBrief, Apr 2026 ] .

04 Claude Code security best practices for this week

Split the work in two. The first list cleans up what is already out. The second stops it happening again. An IT lead can get through both in a week, without banning the tools your developers rely on.

SpyCloud and Apiiro published within a week of each other, and they describe one problem from two ends. AI coding agents gather credentials in places your existing controls were never told about: a token file on the laptop, a JSON file in the repository. Our AI security testing maps those places the way an attacker would. If you build agents of your own, we find out what they can be talked into, through an AI penetration test for LLM agents or full AI red teaming. Start with a free audit of one developer machine and find out what a stolen agent login opens before someone else does. Your red team. Within reach.