Security firm Apiiro says 1,122 public copies of a Claude Code settings file on GitHub hold at least one secret, such as a password or key, saved after developers picked "Yes, and don't ask again". It did not test whether those secrets still work, though one company it notified confirmed its key had been live.
Apiiro: Claude Code's "don't ask again" file holds secrets on public GitHub
When a user picks that option, Claude Code can save the command word for word in .claude/settings.local.json, including any password typed into it, The Hacker News reports. Those 1,122 copies are about 1.1% of the 104,185 Apiiro found, and they hold 1,379 different secrets, including 379 database passwords and 23 AWS keys. Apiiro says none of four related bug reports got a reply from Anthropic. Boris Cherny, who leads Claude Code, replied on Hacker News that the file is meant to stay local and that Anthropic is "looking into what we can do to prevent this".
Why it matters: if your developers use Claude Code, search your GitHub organisation for this file and .claude/settings.json, including git history. The researchers' advice is to change every password, token and key it has ever held first, then clean up.
Bombay High Court quashes a customs order citing two untraceable rulings
In an order dated 30 October, the court set aside, by consent, a Mumbai customs commissioner's order against Quanta Logistics, LawChakra reports. The company said that, to the best of its knowledge, two Supreme Court judgments cited in the order exist in no law report or database and appear to be AI hallucinations. The High Court recorded no finding of its own on how the order was drafted, and the customs dispute will be heard afresh.
Why it matters: check every citation in anything AI drafts for you. If a notice or order quotes a ruling against you, ask for a copy.
Anthropic reportedly must face claims over Claude Max's "5x or 20x" promise
Magistrate Judge Alex Tse ruled on Friday that Anthropic must face key claims that it misled customers about usage on its $100 and $200 Max plans, TNW reports, citing Courthouse News. TNW has not read the ruling. Max users get five or 20 times more use than Pro in each five-hour session, but their weekly limits are not five or 20 times higher. Anthropic argued that customers should understand the extra usage as applying per session, and pointed to a help page. Tse dismissed several other claims.
Why it matters: when you buy AI seats, ask what a usage multiple applies to: a session, a week or a month.
Microchip's CEO says AI companies "took over the whole factory"
Microchip CEO Steve Sanghi told investors on 5 November that standard products that used to ship in four to eight weeks now take six to 32 weeks, 24/7 Wall St. reports. Data centre buyers have taken packaging and test lines at outside assembly and test houses, and moving that work takes about six months.
Why it matters: orders placed inside the new lead times often go unfilled, 24/7 Wall St. writes. If your products use chips, check lead times with your suppliers.
Grok API text now carries an invisible watermark by default
From 7 November, text from listed Grok models includes a watermark on every API endpoint, SpaceXSI's documentation says, to comply with the EU AI Act. Team admins can opt out per model, but must confirm that a legal exception applies to their use.
Why it matters: if you build on the Grok API, have an admin check this setting. Opting out makes you solely responsible for any marking the law requires.
AWS lets one GPU serve several models on SageMaker
AWS added GPU partitioning to SageMaker AI endpoints on 6 November, splitting a GPU into as many as seven isolated parts, depending on the GPU, each able to hold a different model. The launch Regions include Singapore and Tokyo but not Mumbai. In AWS's test, half an H100 was 18–34% cheaper per million output tokens than a whole A100 above a certain load, and the A100 was cheaper below it.
Why it matters: if you host a few models, you may not need a whole GPU for each. AWS says to compare on your own workload.
Worth watching: whether Anthropic changes how Claude Code saves approved commands, and whether Microchip's delayed orders show up in its March-quarter guidance.
Arthat AI
Working on something similar at your company?
Arthat AI builds these automations for Indian businesses every week. If you want to talk through whether this fits your situation, we'll give you a straight answer — even if the answer is "don't build it."
