Claude security: your secrets in a settings file, and an extension that runs code

Three security stories about Claude in one week, and none of them is a classic hack. Nobody broke an encryption or stole a password database. In each story the agent did what it was allowed to do. The problem sat in the approval: one saved forever, one clicked by a script, one never asked.

1. "Don't ask again" saved your secret

When Claude Code asks to run a shell command, one answer is "Yes, and don't ask again". Claude Code then writes a permission rule into .claude/settings.local.json in your project. The rule can hold the command word for word. If the command had a token or a password in it, the file now has it too. Claude Code adds the file to your global git excludes, but that protects one machine only: your project's .gitignore does not list it, so a clone, a copy or a file made by hand can still be committed.

Apiiro, a security company, went looking on public GitHub. Of 104,185 public copies of that file, 1,122 held a real secret, 1,379 distinct secrets in total. Add git history, the shared settings.json and agent transcripts, and they count 2,539 secrets in 1,994 public repositories.

The number that stays with me is a different one. Two common secret scanners, TruffleHog and gitleaks, both missed the secret in 215 of those 1,122 files, about one in five. Apiiro did not test whether the secrets still work, although one affected organisation confirmed its key was live. A Claude Code team member replied that the leaked files were created by hand, not by the agent. Either way, the file ended up in Git.

An approval you save is a line of config. Treat it like code, because Git does.

2. A browser extension that drives Claude on your desktop

The second story comes from Forever Security, who call it ThisBash. Claude Dispatch lets you send a task from claude.ai to Claude Desktop on your computer. Their proof of concept is a browser extension that may run scripts on claude.ai. It opens a small popup in the background, finds your paired desktop session, sends Claude four prompts, and clicks "Allow" on every approval by itself. In their demo Claude installs an npm package whose install script opens the Calculator. You do nothing.

Read the condition before you panic: a malicious extension must already be installed and allowed on claude.ai. Per the researchers, they reported it on 14 May, Anthropic called it valid but already known internally, and on 13 October said it was targeting the end of October to retire Dispatch. Reports since say Dispatch is closed to new users but still running for existing ones. Anthropic has not commented publicly, so treat the timeline as the researchers'.

The lesson is bigger than Dispatch. A confirmation button only proves consent if a person clicks it. In a page that an extension controls, nothing tells you who clicked.

3. Your email in a header

The third one I wrote about on Friday: Claude Code put the signed-in account email in the User-Agent of requests to other sites. The full story, the fix in 2.1.317 and what it does not cover are in Claude Code leaked your email.

One weak spot

Put the three next to each other and they are the same story. The model did not break. The approval did: a yes that became config forever, a yes that a script gave for you, and a question nobody asked.

What to check right now

Find the file. In every repository run git ls-files | grep settings.local.json. If it shows up, run git rm --cached .claude/settings.local.json and add .claude/settings.local.json to .gitignore.
Rotate what it ever held. Removing the file does not clean git history, forks or clones. Check with git log --all -p -- .claude/settings.local.json, and rotate every key you find there.
Keep secrets out of commands. Let the agent read them from an environment variable. Approve patterns like Bash(npm run test *), not one command with a token inside. One line in AGENTS.md covers it: never write a secret value into a command.
Review your browser extensions. Remove the ones you do not use, and look hard at any that may "read and change data on all sites". Work in a browser profile with only the extensions you need.
Turn off what you do not use. Remote and cross-device features like Dispatch belong on the list of things the team switches on deliberately, not by default.
Check the version. claude --version on every machine, 2.1.317 or later, for the partial email fix.

The first two checks, as commands you can paste in each repository:

# 1. Is the file tracked?
git ls-files | grep settings.local.json
 
# 2. Stop tracking it and ignore it from now on
git rm --cached .claude/settings.local.json
echo ".claude/settings.local.json" >> .gitignore
 
# 3. Everything it ever held, in every branch: rotate what you find
git log --all -p -- .claude/settings.local.json
 
# 4. Claude Code version on this machine
claude --version

None of this needs a security team. It needs fifteen minutes and someone who owns it.

Sources

Apiiro, Coding Agents Are Leaking Your Secrets to GitHub, 5 November 2026
Gal Weizman, Forever Security, ThisBash Escape: Claude Dispatch Flaw Enables Browser Extensions RCE on the OS, 4 November 2026