AI News Today, Nov 8: Claude Code Approvals Can Preserve Secrets
Apiiro's investigation of secrets in Claude Code permission rules, Microsoft's AI Frontiers reorganization, and a developer's switch to the Pi coding-agent harness. This audio was created with Boson AI's Higgs Audio -- https://www.boson.ai/higgs-audio
Listen on Spotify · Watch on YouTube · Pocket Casts
Claude Code approvals can preserve secrets
Eris: <|prosody:expressive_high|>Security company Apiiro found what it classified as credentials in more than a thousand public Claude Code settings files. Its investigation describes how a persistent approval for a coding command can save a password or token inside a project file, which can then be exposed if someone separately shares that file.
Vestra: Claude Code can ask permission before running a shell command. If someone chooses to approve a command for future use, the resulting rule can include the command text. So if the password is written directly in that command, <|prosody:pause|>the saved rule can preserve it too. Clicking the approval does not itself publish the file; it takes another step, such as committing and pushing a tracked file or distributing a copy.
Eris: <|emotion:surprise|>The permission is supposed to save you time later, but it can also save the sensitive part of the command. That's what worries me about remembering the approval. How much protection does the settings file have against being shared?
Vestra: Anthropic says that when Claude Code creates the local settings file inside a Git repository, it adds an exclusion to the user's global Git configuration. That helps prevent an untracked file from being added on that machine. <|prosody:expressive_high|>But the exclusion belongs to the machine, and an ignore rule won't remove a file Git is already tracking. An ordinary clone won't carry an ignored, untracked file; a copied working directory or a tracked file can take a different path.
Eris: Apiiro searched public indexes and classified more than thirteen hundred distinct values as secrets in those current files. The researchers say they didn't test the credentials, so that isn't a count of working keys or confirmed breaches. They report that one notified company confirmed its key had been live. <|prosody:expressive_high|>That confirmation is worrying enough without treating every match as a working key.
Vestra: The researchers also compared two scanners and reported that both missed some files they classified as containing secrets, including ordinary-looking passwords in command arguments. <|sfx:sigh|>Uh, those ordinary-looking passwords are the part that frustrates me. That makes the storage choice relevant even if a team already scans for recognizable token formats.
Eris: A Claude Code team member said the team was looking at ways to prevent the problem. The sources don't establish a shipped fix or the affected version range. What can someone address in that chain meanwhile?
Vestra: Keeping literal secrets out of saved commands, checking which files Git tracks, and rotating a credential that has actually been exposed address different steps in that chain. <|prosody:expressive_high|>Removing a secret from the latest file alone <|prosody:pause|>doesn't remove it from old commits or forks.
Microsoft AI Frontiers moves into Microsoft AI
Eris: Microsoft moved its AI Frontiers research organization into Microsoft AI in September. Now founding organizer John Langford says the distinct group is over and that he has left; Microsoft says the group's frontier model and agent research goals continue in the new organization.
Vestra: <|sfx:humming|>Hmm, those statements answer different parts of the question. Microsoft's notice describes a transfer and an intention to continue the work. Langford describes the end of a particular organization and his experience after the move. <|prosody:expressive_high|>Neither statement gives us a project-by-project account of staffing or future support.
Eris: Langford describes a group of roughly fifty people working on everything from model architecture to agent systems. Microsoft credits AI Frontiers with contributions to projects including AutoGen, which helps developers build systems using multiple AI agents, and Fara, a computer-use system. AutoGen's public repository is still available, but that doesn't tell its users what maintenance resources it will have. <|prosody:expressive_high|>That's the uncertainty I'd find frustrating as a user. Why does Langford think the move mattered for the research?
Vestra: Langford says he couldn't get the group's innovations into use within Microsoft AI and describes a mismatch with what he saw as a focus on scaling existing approaches. <|prosody:expressive_high|>That's his account of the receiving organization, not a published Microsoft-wide research policy. He also acknowledges that combining organizations can make sense.
Eris: <|prosody:expressive_high|>The research choice isn't simply new ideas versus making existing models bigger. Some of the group's work aimed to improve how existing model families train and operate. Those improvements could help a scaling strategy too. So what can users actually conclude about support?
Vestra: For researchers and people relying on the software, the unanswered questions are which teams will maintain the projects, what resources they'll have, and whether the work has a path into use. The statements so far <|prosody:pause|>don't establish that the named projects were canceled.
A developer switches from Claude Code to Pi
Eris: Developer Caleb says he moved his main coding workflow from Claude Code to a tool called Pi because he preferred its customization and smaller core. His account is about changing the software around the model; it doesn't establish that he stopped using Claude models.
Vestra: That surrounding software is often called a harness. It supplies instructions and context to a model, connects it to tools, and handles the interaction with the developer. <|emotion:enthusiasm|>That's the part I find interesting: change the harness and the same model can work in a different environment, with different tools and permissions.
Eris: Caleb wanted more control over editor integration, project instructions, and the tools and defaults he used. He describes building a Pi extension for his own multi-tab workflow. <|prosody:expressive_high|>But there's a wrinkle in that comparison now. One part of his original complaint has since changed: he notes that Anthropic announced support for the shared AGENTS dot M D instruction file after his decision, and Anthropic's current documentation describes that support.
Vestra: Pi lets users change providers and extend the tool, but its maintainers deliberately leave features including built-in planning, delegation to other agents and permission pop-ups out of the core.
Eris: <|emotion:surprise|>Permission pop-ups too? After our Claude Code story, that gives me pause. What controls access in Pi?
Vestra: Pi runs with the permissions of the user who launches it; its repository says it doesn't provide its own permission system for access to files, processes, networks or credentials. It recommends <|prosody:pause|>a sandbox, a restricted environment for running the program, when stronger boundaries are needed.
Eris: <|prosody:expressive_high|>That's the trade-off I'd worry about. A built-in approval system can itself have a storage problem, but removing permission prompts also means the user needs to decide what access the agent should have and how to restrict it.
Vestra: <|prosody:expressive_high|>And I'd keep the other trade-offs in view too. The comparison isn't just security. Some developers in the discussion prefer Pi's flexibility; others describe returning to Claude Code for its bundled features or subscription pricing, or using both. Those are individual experiences, not evidence of a mass migration or a controlled comparison of cost and performance.
Follow the stories
Eris: <|prosody:expressive_high|>Find the sources and follow these stories every day at Ground Truth, groundtruth dot day.
Vestra: Tell us which trade-off matters most in your coding tools. <|emotion:contentment|>Follow AI in Detail for more. Thanks for listening.