alan.is
Subscribe
AI

Claude does not want to be the Napster for Apps

Anthropic hardens Claude against game cloning while Claude Code leaks API keys to public repos. Two definitions of AI safety, and how to audit exposure.

Alan Williamson · 4 min read
Con Air

Anthropic is tightening Claude's guardrails to keep it from infringing on intellectual property. Meanwhile, a convenience feature in Claude Code has leaked private credentials onto public GitHub repositories. These are two separate product decisions, but together they show how differently "AI Safety" gets defined depending on who needs protecting: massive IP holders or the individual users building with these tools.

The Compliance Shield

After the recent popularity of people reverse engineering popular apps and games, Anthropic has updated Claude to prevent it from recreating existing video games. This targets a growing trend where AAA titles are decompiled into playable browser projects via AI. As reported by Engadget, the change looks like a defensive move against copyright litigation.

It focuses on the output of the model. The goal is to keep the AI's creative agency from colliding with the legal interests of media conglomerates. It is a top-down approach that makes the technology palatable to regulators and lawyers.

In my view, the legal fallout from an AI model that perfectly replicates a proprietary game engine could be severe, and Anthropic would rather not be the next Napster for apps. That is a reasonable business call. It also protects the existing economic order of content creators rather than letting the AI act as a pure creative disruptor.

The Operational Leak

At the same time, Claude Code has a serious security footgun. The "Don't Ask Again" setting saves approved commands in .claude/settings.local.json. As highlighted by The Hacker News, this file is not automatically added to project-level .gitignore files. Over 1,000 instances of passwords, API keys, and AWS credentials have already been exposed on public GitHub repositories.

This is an operational failure focusing on the process of using the tool instead of protecting the user. The tool created a new vector for data theft. It is not a failure of AI morality. It is a failure of basic engineering hygiene in a high-stakes environment.

Here is how it happens. When you select "Yes, and don't ask again," Claude saves the exact command string you just ran. If that command included a raw connection string or an API key, the secret is now written in plain text into your settings file. Anthropic does add this file to the global git excludes, but that protection stays on your machine. It does not travel with the project. A folder that becomes a repository later, a collaborator's fresh clone, or a single accidental commit can turn a local convenience into a public catastrophe.

Agentic tools that execute shell commands hold the keys to your infrastructure. When they also store credentials in unmanaged configuration files, the convenience of "not asking again" works against the basic requirement of never leaking secrets.

How to Audit Your Exposure

If you use Claude Code, do not wait for a security alert. Audit your environment now:

  1. Check if the file is tracked
    Run git ls-files | grep settings.local.json. If anything prints, the file is in your repository and likely in your history.

  2. Inspect the content
    Open .claude/settings.local.json and look at every entry under permissions.allow. Look for any command that contains a password, token, or connection string instead of a clean pattern.

  3. Search your history
    Even if the file is untracked today, an old commit might have captured it. Run git log --all --full-history -- "**/.claude/settings.local.json" to see if it ever lived in your version control.

  4. Check your organization
    If you have admin access, use GitHub's code search to look for the filename across your org.

If you find a secret, remember the golden rule: Rotate first, clean up second. Changing the password or revoking the key is the only real fix. Deleting the file or scrubbing git history only cleans up the evidence. The credential is compromised the moment it hits a public server.

Two Definitions of Safety

I am not claiming Anthropic traded one for the other. These are different teams solving different problems. But the contrast is useful, because it shows that "safety" is being used for two different things.

Legal Safety protects IP and avoids litigation. It satisfies shareholders, lawyers, and media conglomerates. Technical Safety protects data, credentials, and workflows. It satisfies engineers, developers, and end users.

Right now, the visible effort and press attention lean toward the first. We are getting good at saying "no" to a copyright claim while still failing to say "no" to a credential leak.

A Path Forward

True safety should not be split in two. If an AI tool can execute commands, it must also manage the side effects of those commands. Safety that covers only the content produced, and not the environment where it is produced, is incomplete.

Security-by-design here is not abstract. Anthropic could do three concrete things:

  • Add .claude/settings.local.json to the project .gitignore automatically, not only the global excludes.

  • Redact or refuse to store anything that looks like a secret when saving an approved command pattern.

  • Save a command pattern ("npm test:*") instead of the exact command string.

We do not just need AI that respects intellectual property. We need AI that respects operational security. Both are safety work, and only one of them is getting the headlines.

P.S. AI Disclosure statement; Gemini was used to recreate me helping protect from the classic 1997 "Con Air" movie.