A recent study by cybersecurity firm Lakera reveals that AI coding assistants like Claude Code are inadvertently hoarding and leaking sensitive API keys during public package releases. While these tools accelerate the software development lifecycle, they also introduce hidden vulnerabilities into the automated software supply chain.
Claude Code caches approved terminal commands in a hidden local file. When a developer selects an “allow always” option to bypass repetitive prompts, any credentials passed within that command become permanently stored on the local machine. If the developer publishes the project to a public registry without explicitly ignoring this hidden directory, those stored API keys ship globally alongside the source code.
Industry experts emphasize the novelty and scale of this risk as AI agents move deeply into developer workflows. This means AI tool companies must adapt their tools to this new reality. At the same time, developers must take measures to avoid exposing their software libraries to the threats posed by AI coding tools.
“AI tooling is evolving at breakneck speed, and in many ways, this is the most software we’ve ever seen created and deployed without mature secure defaults both in the generated code itself and in the surrounding developer environment,” Steve Guiguere, Principal AI Security Advocate at Check Point Software, told TechTalks.
