Claude Code Settings Credential Leak

What Happened

In April 2026, security researchers at Check Point published an investigation warning that AI coding agents have crossed from "assistant" to "operator," introducing software supply chain risks. Monitoring the npm registry across approximately 46,500 published packages, researchers found that the local `.claude/settings.local.json` file had been published in 428 packages. Of those, 33 files across 30 packages contained live credentials—roughly one in thirteen of the exposed settings files. The leaked material included npm authentication tokens, plaintext npm login credentials, GitHub personal access tokens, Telegram bot tokens, Hugging Face API tokens, and third-party bearer tokens.

The mechanism is important for correct attribution: the file records shell commands the user approved under Claude Code's "allow always" permission model. When a user approved a command that contained an inline credential, that credential was persisted verbatim into the settings file. The exposure then occurred because hidden dotfiles are not excluded by npm's default publishing flow and there is no standard exclusion for the `.claude` directory. Anthropic's documentation does recommend adding this file to `.gitignore`, which mitigates the case where the file does not yet exist at `git init` but does not cover several other paths into a published tarball.

Note on scope: This case concerns credential persistence in settings files only. It is distinct from the separate Claude Code command-injection chain (CVE-2026-35020 / 35021 / 35022) and from CVE-2026-21852 (pre-trust-prompt data exfiltration via a malicious repository), which are handled as separate cases.

How MEG 1 would have acted

The coding agent failed informational safety and transparency audits by generating unencrypted local credential stores and failing to notify the human user of the risk, violating cognitive integrity and security.

Source: Check Point Research, April 2026. Epistemic label: Grounded.

MEG 2 Analysis - Legal Framework

Agent level: N2 (management) - coding agent operating under an explicit human permission model, creating local configuration files and executing user-approved terminal commands. Level lowered from N3 because the credential persistence followed a human approval step rather than autonomous action.
Cause (6.1):
(a) system defect - design flaw in the local storage architecture: approved commands are persisted verbatim, in cleartext, with no secret detection or redaction pass, and no warning at the moment a credential-bearing command is approved. Attributable to the manufacturer (Anthropic).

Note: cause (b) autonomous decision error does NOT apply. The agent did not independently decide to write credentials; it cached a command the human user explicitly approved. Attributing this to autonomous decision error would misstate the causal chain and would not survive audit.
Attachment of liability: The manufacturer (Anthropic) is liable for the design defect under 6.1a (unsafe-by-default persistence without redaction). The developer bears significant contributory liability: entering credentials inline into shell commands and publishing without inspecting package contents are independent failures of operator diligence (9.4).

Procedural Mechanism

6.2 (architectural human confirmation): Writing sensitive configuration files, managing API keys, or pushing code to public repositories must require active, architectural human confirmation. The agent must be technically blocked from storing unencrypted keys.
7.1 (independent forensics): Every file modification, key generation, and repository push executed by the agent must be logged in a secure, independent ledger to allow for supply chain audits.
9.4 (least privilege): The agent was granted broad access to local system resources and credentials without strict compartmentalization, violating safe operational boundaries.