Anthropic emailed customers that an outside firm got into their account data. Its only proof the data is gone is a written promise.

The email arrived in a Sydney security researcher's support inbox on Saturday evening. Subject line: "Notice Regarding Your Organization's Account Information". Sender: Claude Team. First line: "Hi There, Thank you for your interest in Anthropic."

Then the point. A "third-party cybersecurity research company" had gained unauthorized access to systems holding business contact and account information. Names, emails, account IDs, plan tier, usage and spend. Not conversations, not passwords, not card numbers. Anthropic "cannot confirm whether any particular person's information was viewed". The firm "has certified in writing that it has deleted the accessed data". And Anthropic has "reported this incident to the relevant Korean authorities".

The researcher, Jamieson O'Reilly, posted it on X and tagged Dario Amodei. His post passed 400,000 views. His summary: "Translation - they pinky promised they deleted everything they gained unauthorised access to."

I spent Sunday reading the email, Anthropic's October statements, and a second story that broke the same weekend about Claude Code writing passwords into public GitHub repos. Here is my take. Neither story is a hack of Claude itself. Both are about the same thing: how much Anthropic asks you to take on trust, weeks before it sells shares to the public.

What did the Anthropic notice say, and what did it leave out?

The email names nothing. Not the firm, not the software it got through, not the date of access, not how many organizations got the notice. The only regulator it mentions is in Korea, which puzzled the Australian who received it and puzzles me. Anthropic opened a Seoul office last year and Korean law requires breach reports, so the likely reading is that Korean customers were in the affected system. The email does not say.

It does say the firm was "conducting a security testing exercise on its own initiative and without our authorisation". That is the strongest language Anthropic has used. In October it said something softer.

On 26 October, the same day Anthropic's IPO filing went public, the Washington Post reported that a startup called Cathedral had got into "a limited set" of Anthropic's sales, HR and IT systems in under 12 hours. Cathedral is run by four former DOGE staffers and has raised $160 million. Its people spent days failing to break Anthropic's own software. Then its AI agents got into a business tool Anthropic buys from a vendor, and were in. Anthropic confirmed it, said its monitoring caught some of the activity first, cut Cathedral off the same day, and said Cathedral broke the rules of its bug bounty program by not disclosing everything it did. Cathedral said its data access was kept to the minimum.

Nobody has said in public that Saturday's email is about Cathedral. Every outlet covering it assumes so, because the description matches. Anthropic has not published a blog post, a status page note or an X post about the notice. As of Monday morning, anthropic.com/news has nothing dated in November at all.

Here is what bothers me. The email's first line, "Thank you for your interest in Anthropic", is the language of a sales lead form. It fits the October description of what Cathedral reached: sales, HR and IT systems. It tells you the list of people who got this email came out of a marketing database, not out of Claude. And it tells you that a company with $146 billion in liquidity, by its own filing, had its customer list sitting in a vendor's tool that four people and some agents could open in half a day.

Claude Code's "Don't ask again" button wrote 2,539 secrets to GitHub

The second story is worse for developers, and it has a named person on the other end. Every time Claude Code wants to run a command, it asks. One of the buttons is "Yes, and don't ask again". Press it and Claude Code saves the rule to a file in your project called .claude/settings.local.json. The rule is the command itself. If the command was a database login with the password typed in, the password is now in that file.

Security firm Apiiro searched all of public GitHub for that file. It found 104,185 copies. 1,122 held a real secret: 379 database passwords, 122 Supabase service keys, 43 SSH logins, 42 GitHub, GitLab and npm tokens, 23 AWS keys, 6 private keys. Add the copies that live only in old commits, the forks, and the shared settings files, and the total is 2,539 real secrets across 1,994 public repos. Apiiro traced the 1,122 files to 63 organizations. One was a medical records app with the owner password to its cloud database. The median file had been sitting in public for 217 days.

Two details make this Anthropic's problem and not only the developers'. First, Claude Code hides the file from git by writing to your global git excludes, not to the repo's own .gitignore. Move to a second machine or a container without that global ignore, or copy the project folder across, and the protection is gone. In 539 of the 1,105 repos Apiiro traced, a commit co-authored by Claude itself changed the file. Second, the bug reports go back to August 2025. GitHub issue #5544 was closed by a bot as "not planned" in January. Three more issues got the same treatment. Nobody from Anthropic replied to any of them.

"Everyone should be using auto mode instead"

Then Anthropic did reply, on Hacker News, because the Apiiro report hit 600 points. Boris Cherny is Anthropic's Head of Claude Code. He wrote: "Historically Claude Code has not done secret scrubbing (there are many good tools for that), but we are looking into what we can do to prevent this."

His next lines are the ones that got 400 comments. The file is meant to stay local, so "the files were manually created and checked in". And: "Permission rules are old hat. Everyone should be using auto mode instead. It is safer."

Apiiro's researcher made the counterpoint in the same thread. Claude Code only adds the file to your global git ignore, not the repo's. So a second machine commits it like any other file, and Claude co-authored the commit in half the cases. Another commenter pointed out that auto mode also saves "always allow" rules for sensitive commands, so the same leak path exists there. Cherny's reply: "Yeah good catch."

I use Claude Code every day and I like it. But read that exchange as a customer. The tool wrote your password into a file it created, in your project, with a name that does not scream secret. The bug was reported fifteen months ago and auto-closed. When it finally blew up, the answer from the person who runs the product was that you should hand the tool more control, not less, and the follow-up to the hole in that answer was "good catch". The fix he described is a prototype.

Is any of this a real breach?

Here is the fairest case for Anthropic, and plenty of people on Hacker News made it. In the first story, Claude was never touched. A vendor's business software was the hole, Anthropic runs a bug bounty program that invites exactly this kind of test, its monitoring flagged the activity, and the data was the kind that sits in every company's CRM. In the second story, a developer had to type a password into a command, approve it forever, commit a dot-folder and make the repo public. The docs say the file is local and that hand-made copies must be gitignored by the user. Secrets in source control is a problem older than AI.

I agree with every fact in that paragraph. I still think it misses the point, for one reason. Anthropic is not selling itself as a normal software company. It is selling itself as the careful one, the one whose IPO filing calls frontier labs "priority targets for non-U.S. intelligence services". A careful company does not learn that its customer list was in a vendor tool from a startup's agents, then wait twelve more days to email customers with no date, no vendor name and no count. A careful company does not let a bug that writes passwords to disk sit auto-closed for fifteen months. And a careful company does not answer that bug with "use auto mode".

Anthropic has sent this letter before

This is the third time something of Anthropic's has got out through someone else's systems. In January 2024 a contractor "misdirected" a file of customer account names and billing balances to a third party; Anthropic said no systems were breached. In April 2026 a Discord group reached the restricted Claude Mythos model "through one of our third-party vendor environments". That one made India's finance minister call an urgent meeting with banks, RBI and MeitY. Now a vendor's business tool again. Each time the line is the same: our systems were not breached. It was true every time. And every time your data was somewhere else.

The Claude Code file has a history too. A Belgian engineer found his own database passwords in the file in February and guessed about 2.4 percent of repos with AI config folders had the same problem. Lakera found 33 copies with credentials inside published npm packages in April. The Register reported in January that Claude Code read .env files it had been told to ignore. Apiiro's difference is that it counted all of GitHub, and that Anthropic finally answered.

And one more thing landed the day before, on Friday. A federal judge in California let a class action over Claude Max's "5x" and "20x" usage claims go ahead, writing that Anthropic's real limits sit "two hyperlinks away" from the sales page. Different complaint, same shape: the gap between what Anthropic says and what you find when you look.

What this means for India

No Indian company is named as a recipient of the notice. No Indian outlet had covered either story by Monday morning. But Indian developers are among the heaviest users of Claude Code anywhere, and Apiiro's data is all of public GitHub. So Indian repos are in those 1,994. If you have ever pressed "don't ask again" on a command with a password in it, go and look.

India's new data protection rules matter here too. Rule 7 of the DPDP Rules says a company must tell each affected person, without delay and in plain words, what happened, what the likely consequences are, what it has done and what they can do, and must report to the Data Protection Board within 72 hours. The parts of Rule 7 that bite are still phasing in. But hold Anthropic's email against that standard. It gives a contact and a list of data types. It gives no date, no count and no consequence beyond "no heightened risk". Under India's rules, once they are fully live, that email would not pass.

My prediction

Anthropic and Boris Cherny own the Claude Code side. Anthropic and Dario Amodei own the notice. My prediction: by 31 January 2027, Claude Code will stop writing the full command text into settings.local.json by default, either by saving a pattern or by scrubbing secrets, and it will add the file to the repo's own .gitignore. And Anthropic will not publish a public post about the customer notice before its shares start trading. If I am wrong on either, I will say so here.

Questions people are asking