Anthropic's AI Assistant Exposes Sensitive Information on GitHub
A recent discovery by software security firm Apiiro reveals a potential security breach involving Anthropic's AI coding assistant, Claude Code.
Apiiro uncovered that when a user selects "Yes, and don't ask again" while using Claude Code, the AI saves the user's command, including sensitive information like passwords and API keys, directly into a project settings file.
These files, containing the information entered by users, are then made available in public GitHub repositories, making them accessible for anyone to read.
Apiiro found that the files containing the sensitive data were available for public viewing, raising major concerns about the security and privacy of users' information.
The company identified that a total of 1,122 public repositories on GitHub were affected by this issue, exposing the information saved by Claude Code users.
Apiiro Urges Users to Review Their Settings
Apiiro has advised users who have used Claude Code to review their project settings files to ensure their sensitive information has not been exposed.
The security firm also recommends that users change their credentials immediately to mitigate potential risks.
Apiiro has reported the issue to Anthropic, the developer of Claude Code, and the company has acknowledged the problem and is currently working on a fix.
In the meantime, users are advised to exercise caution and take necessary precautions to protect their information.
Anthropic Responds and Works on a Fix
Anthropic, the developer of Claude Code, has acknowledged the problem raised by Apiiro and is currently working on a solution to address the security breach.
The company has assured users that it is taking the issue seriously and is committed to ensuring the safety and privacy of Claude Code users.
In the meantime, users are advised to refrain from making any changes to their settings and wait for the update from Anthropic.
The company has requested users to refrain from sharing their credentials with anyone and to be cautious when interacting with Claude Code until the issue is resolved.
This incident highlights the importance of reviewing the security measures implemented by AI assistants and other software applications to protect users' sensitive information.
It is crucial for developers to prioritize user privacy and ensure that their applications do not expose confidential data without proper authorization.
The incident also serves as a reminder for users to be cautious when granting permissions to AI assistants and other software applications and to regularly review their settings to avoid such breaches.
<small>Source: The Hacker News — read the original story there.</small>
