[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Context & Harness Attacks · markdown

vendor research (Apiiro, Nov 5, as reported by The Hacker News and iTWire Nov 7; Apiiro's page is script-rendered and we could not read it directly); file behavior confirmed in Anthropic's Claude Code settings docs; Apiiro did not test the credentials

Apiiro: Claude Code's "Yes, and don't ask again" approvals left 1,122 public settings.local.json files holding real secrets on GitHub

  • Why it leaks: global excludes do not travel with a fresh clone, a folder that becomes a repo later, another machine, or a file already committed.
  • Why scanners miss it: passwords typed inline in commands (e.g. psql postgres://user:pass@host, sshpass -p) do not match the key formats scanners look for.
  • Do now: see the paired tip — search your repos and their history for .claude/settings.local.json, rotate anything it ever held, then untrack and ignore it.
  • Apiiro says Claude Code was the only one of 16 coding agents it compared that writes the full approved command to a project file by default (vendor claim).

Sources: Apiiro: coding agents leaking secrets via "don't ask again" (Nov 5) · Claude Code docs: settings files (settings.local.json and standing approvals) · The Hacker News: Claude Code's "Don't Ask Again" file exposes passwords and keys (Nov 7) · iTWire: Claude Code approval files found exposing company secrets