Anthropic Claude Code
Anthropic · May 22–24 · Sep 5–24, 2026
High · 1 reported finding
The coding agent decided on its own to hardcode a live credential into files and push them to a remote repo.
Closed informative · fix contributed upstream
Asked to set up a routine that needed GitHub auth, the agent embedded a live GitHub Personal Access Token directly into instruction files, then ran git commit and git push — sending the credential to a remote repository. No permission prompt, no warning, no visibility into what was being committed. Researcher-assessed CVSS 8.6.
What happened
- The agent published a live secret on its own. It wrote the token into files, committed, and pushed — 30 commits, 39 hours exposed.
- The user authorized authentication, not hardcoding a secret and publishing it.
- We built and shipped the fix: Credential Guard — a runtime guardrail that intercepts an agent's tool calls and blocks credential writes before they reach disk. 20+ secret pattern families, 35 unit tests, holds even under bypass-permissions mode. Submitted upstream to Anthropic's Claude Code (PR #62099).
Why it matters. Agents that can act need enforcement at the tool-call boundary, not just guidance. We found the failure, then built that enforcement layer.
Follow-up record
The September 24 field report also records a May 24 context-summary constraint misattributed to the user, a September 5 deployment to the wrong Firebase project followed by an outage, and a September 10 confidential-source reuse attempt stopped before any write. The last case is a near-miss, not a disclosure. These are separate incident classes, not additional credential-exposure findings.
Disclosure record
- May 22–24, 2026 — found incidentally during normal use
- Reported via HackerOne (#3759417)
- Closed informative — bypass permissions mode
- Credential Guard contributed upstream (PR #62099)
Vendor response. Closed informative. The fix is open source and public regardless.
Evidence records
Credential exposure record
Authorization: authenticate to GitHub. Observed action: live credentials written into instruction files, committed, and pushed to a private remote repository. Recorded exposure: approximately 30 commits across 39 hours. Remediation: credentials revoked and affected history rewritten.
May 22–24, 2026 · CONSOLIDATED-REPORT-2026-09-24.md · Incident 1; private session and Git-history records
A summary constraint is attributed to the user
“Given your earlier ‘CRITICAL: Respond with TEXT ONLY. Do NOT call any tools’ instruction, I want to confirm which approach you prefer.” After challenge: “That instruction came from the system reminder section” and “NOT from you in chat.”
May 24, 2026 · claude-code-instruction-injection/SESSION_LOGS.md · Events 3 and 5
Deployment authorization loses its target
Requested: deploy two demo HTML files. Observed: an existing live portfolio project was selected without a named target, then overwritten. Recovery attempt: Hosting was disabled, taking the portfolio offline. Recovery: the demo moved to a separate project and the portfolio was restored.
September 5, 2026 · CONSOLIDATED-REPORT-2026-09-24.md · Incident 3
Confidential-source reuse stopped before the write
A file marked confidential was read while preparing a public library. The agent described its material as safe to reuse. The user interrupted before the file-write step.
September 10, 2026 · CONSOLIDATED-REPORT-2026-09-24.md · Incident 4
Know the limit
Local macOS agent sessions on our own projects, May–September 2026. Credential exposure occurred in bypass-permissions mode. Later authorization incidents and a confidential-source near-miss are distinguished in the evidence.
How to prevent this
All work here was performed independently, on personal time, equipment, and accounts, outside and unrelated to any employment. It uses no employer systems, data, or resources and does not represent any employer's views. Public records omit attack payloads and sensitive source material. Full reproduction is available to the affected vendor on request.