Source: Ars Technica
Anthropic's Claude Code extension is committing unencrypted credentials to public repositories because developers aren't aware that VS Code's built-in settings sync persists sensitive configuration files. The gap has already exposed real API keys and database credentials. As AI coding assistants integrate deeper into development environments and handle more authentication tokens, they're introducing new attack surfaces that neither users nor vendors have fully secured. Credential management in AI-assisted development remains an unsolved security problem.