TL;DR
What should I do if I pasted an API key into an AI tool?
Last week, passwords turned up in public Claude Code files, and chatbot builder Botpress had a breach. If you've pasted keys into AI tools, some may be exposed. List where you pasted them, create new keys at each provider, delete the old ones, and stop typing keys into chats and commands.
Why are AI tools leaking API keys?
An API key is a long password that lets one app use another, such as a chatbot builder calling OpenAI on your account. Whoever holds it can spend your credit or read your data.
Last week gave two reminders of where those keys end up. Security firm Apiiro found that Claude Code's "don't ask again" option can save a full command, key included, in a project file, and 1,122 of those files were sitting on public GitHub. Our Claude Code report has the numbers. The same Friday, November 6, 2026, Botpress said an attacker read bot setups in 16 customer workspaces and told those customers to treat every stored credential as exposed.
Neither story needs you to be a coder to matter. If you've built a chatbot, connected an automation app or tried vibe coding (building apps by describing them to an AI), you've probably handed a key to a tool.
Where have I pasted my API keys?
Spend three minutes making a list. Most people find keys in the same few places:
| Where | Typical keys | Why it's a risk |
|---|---|---|
| AI coding tools (Claude Code, Cursor and similar) | Database passwords, cloud keys, GitHub tokens | Approved commands and settings files can be saved in your project |
| Chatbot builders (Botpress and similar) | OpenAI, Anthropic or Google AI keys, messaging tokens | The platform stores them, so a breach there exposes them |
| Automation apps | CRM logins, email and payment keys | One account holds keys for many services |
| Chat windows | Anything you pasted "just to try it" | Chats are saved in your history |
Write down each service whose key you gave out. That list is your to-do list for the next step.
How do I rotate an API key?
Rotating means making a new key and switching off the old one. Do it at the provider that issued the key, such as OpenAI, Anthropic, Google or your database host, not in the tool where you pasted it.
Deleting a file or a chat doesn't kill a key. Only the provider can do that.
For each service on your list: create a new key in the provider's dashboard, paste the new key into the tool that needs it, then delete the old key. Check the provider's usage page while you're there. Spending you don't recognize is the clearest sign a key was used by someone else.
What should Claude Code users clean up?
Open .claude/settings.local.json in each project. Claude Code's settings docs say this is where your local permission rules live. Delete any saved rule that has a password, token or key in it, and rotate those keys too.
Then make sure the file never reaches GitHub. The docs say Claude Code keeps it out of Git when it creates the file, but "if you create it by hand, add it to .gitignore yourself." A .gitignore is the list of files Git won't upload.
Going forward, approve patterns rather than exact lines. "Allow running my build script" is safe to remember. "Allow this command with my database password in it" isn't.
People are clearly wrestling with this. One r/ClaudeAI thread is titled "Dealing with permission requests," and another "Claude CLI now allowed to run commands with sudo without asking for confirmation." The prompts are annoying, and the shortcut around them is where the risk lives.
How do I stop this happening again?
Turn on GitHub secret scanning for your repositories. It looks for known key formats and alerts you when one shows up.
Then change one habit. Keep keys in one place, such as a password manager or your tool's environment-variable settings, and paste them only into the field built for them. Never drop a key into a chat or a command "just for now." Set a monthly reminder to glance at each provider's usage page.
We think this is the most useful 10 minutes most AI users can spend this week. It's dull work, and that's the point: the people who get burned by leaked keys are rarely the ones who checked.
FAQ
How do I know if my API key was used by someone else?
Check the usage or billing page at the provider. Calls or spending you don't recognize, especially at odd hours, are the main warning sign.
Do I need to rotate keys if my GitHub repo is private?
It's lower risk, but rotate any key that sits in a file other people or tools can read. Private repos can become public or be shared later.
Can I ask ChatGPT or Claude to check my code for keys?
You can, but that means pasting the code, keys included, into another chat. GitHub secret scanning does the job without that step.
I'm not a Botpress customer. Do I need to do anything?
Botpress said it sent each affected customer the list of bots and integrations involved. The same rotate-and-check routine applies to any platform that stores your keys.
Sources
- Apiiro: Coding agents leaking secrets on GitHub — November 6, 2026. 1,122 public files with secrets.
- Botpress: Security incident disclosure, November 2026 — November 6, 2026. 16 workspaces; treat stored credentials as exposed.
- Claude Code docs: Settings —
.claude/settings.local.jsonand the .gitignore note. - GitHub Docs: About secret scanning.
- r/ClaudeAI thread titles via Google search results: Dealing with permission requests and Claude CLI now allowed to run commands with sudo.
