self.md radar — 2026-11-09
the password in the permission rule
check .claude/settings.local.json before the next push
Apiiro counted public copies of that file, then checked their old versions too
1. Claude Code’s saved approvals contain passwords
choosing “don’t ask again” can store the command itself as a permission rule, password included
Apiiro found credentials in 1,122 of 104,185 public .claude/settings.local.json files
gitleaks and TruffleHog both missed 215 of the files the researchers classified as secret-bearing
Claude Code adds the local settings file to a global ignore list, according to the audit
that protection does not travel with the project or protect a file already tracked by Git
earlier versions held another 734 secrets absent from current copies
in his November 7 response, Boris Cherny says the file should stay local and recommends auto mode and secret scanning
Apiiro’s November 8 update records plans to prototype built-in secret scanning, not a shipped repair
the researchers did not test the credentials; their classification does not establish that every one still works
check history and rotate exposed credentials before cleaning up files
reading: Apiiro’s collection method, scanner comparison and response update
2. retries kept vLLM overloaded after the spike ended
calls returned to 60% of calibrated capacity after a 107-second load spike
with retries still arriving, cancellation did not restore service in any tested run
the new overload study uses vLLM 0.30.0, one H100 and three open models
with retries and cancellation enabled, only 12–38% of calls arriving after the spike were delivered within 840 seconds of their planned arrival
in the detailed Qwen2.5-7B traces, retries typically began processing their prompts less than half a second before their own timeout
a retry budget restored service by refusing some retries, leaving many earlier callers without answers
coalescing instead attached retries to the original execution and delivered every call from the spike onward, some late
that stopped working when cancellation had already destroyed the execution a retry needed to rejoin
these are synthetic single-turn experiments with one retry policy, not a measurement of all production endpoints
reading: Cancellation Is Not Enough: setup, traces and control comparisons
3. NormGym’s forbidden moves still work
a forbidden move remains available in NormGym
after it happens, the agent gets a public red X for one timestep
the benchmark gives a newcomer 200 steps to infer one of 50 arbitrary rules from movement and sanctions
it then freezes the learned belief and tests new situations
the surrounding agents follow scripted A* policies
Claude Opus 5 reaches 55.3% joint success on the familiar layout and 51.3% on unseen layouts
that score requires completing both goals without a single norm violation
when GPT-5.6 Sol is told the actual rule, its familiar-layout joint score rises from 44.0% to 90.7%
the benchmark does not include disputed or changing rules, or delayed and ambiguous sanctions
reading: NormGym’s interaction protocol, Table 1 and limitations