The Claude button that leaks passwords

Welcome back! A Claude Code shortcut has been saving people’s passwords into files that ended up public on GitHub. Claude also tried day trading in a space game, and the newest model came out far ahead. Meta’s Muse now builds you your own apps from a single description. And OpenAI brought in a second outside security team this week to find holes in its own systems.

In today's Generative AI Newsletter:

Claude Code: Which button saved your password in public?

Claude: How much did Claude make as a day trader?

Muse: What app would you ask Muse to build for you?

OpenAI: Why did OpenAI invite hackers in?

Claude Code’s shortcut is leaking passwords

Clicking “Yes, and don’t ask again” in Claude Code can save your password in a file that ends up public on GitHub, where anyone can read it.

And more than a thousand of those files are already out there.

Security company Apiiro searched public GitHub for the file, called .claude/settings.local.json:

104,185 copies of it sit in public projects.

1,122 of them hold at least one password, key or token, saved word for word in plain text.

379 database passwords and 23 AWS keys were among them.

2,539 secrets turned up across 1,994 projects and 63 organizations once Apiiro also checked older versions of the files.

1 of them was the owner password to a medical-records database.

Anthropic’s head of Claude Code, Boris Cherny, replied over the weekend that the team is “looking into what we can do to prevent this,” including built-in secret scanning.

Do you know what Claude Code saved the last time you clicked “don’t ask again”?

This Thursday : Why AI breaks in production (hint: it's the data)

AI works in the demo. On real business data, that's where many teams get stuck.

GenAI.Works' Alex Wang goes live with Ho Bae, Co-founder & CEO of CUBIG, which helps companies get their data AI-ready and keep it that way.

They'll cover:

AI-ready vs. agent-ready data

Why business context matters as much as the data

When a wrong AI answer is a data problem

Build vs. buy as AI use cases scale

Nov 12, 8 AM ET / 2 PM CET

Join the live session

Claude became a day trader

Anthropic gave Claude 3 billion in EVE Online’s game money and told it to make as much profit as it could in a replay of the space game’s real market.

And it got rich doing what human traders do.

It bought items cheaply from players who wanted to sell fast, then resold them to players who wanted to buy fast, usually the same day.

43% was Fable 5’s average gain over two weeks, while the best of 20+ simple trading rules barely broke even.

3x more money came from Fable 5 than from Opus 4.6 over six months, released only four months apart.

8–13% profit per trade, repeated on hundreds of orders a day.

85% of its money was kept in play by Fable 5, far more than older models, which would hurt more in a crash.

1 in 2 runs made money when Claude had to guess where prices were heading.

Your next trader might not need a coffee break.

Muse turns your ideas into apps

Meta’s Muse can now build you your own mini-app from a single description, right inside the app.

And you don’t need to write a line of code.

Meta calls them spaces. You describe an idea, Muse builds it, and you keep reshaping it as you use it.

A school dashboard that finds your kids’ events in school emails and adds them to your calendar.

A shopping hub that pulls together gift ideas, wishlists from your Instagram saves and your Marketplace listings.

A wedding planner with your RSVP list, vendor invoices and to-dos.

An order tracker for small businesses with new orders, customer messages and what needs to ship today.

A trivia game that quizzes you on your favorite movies, music or sports team.

Spaces are live everywhere Muse is available, and Meta is working on ways to let you share them.

Which app would you build first?

OpenAI invited hackers into its systems

OpenAI has teamed up with Hacktron , a security company that builds AI agents to hunt for weak spots, to find holes in OpenAI’s own systems.

And it’s the second outside security team OpenAI has brought in this week, after Cathedral.

Engineers from both companies will pick the most important areas to test together.

The focus is how OpenAI’s systems connect with outside services.

Hacktron gets more access to OpenAI’s most advanced models through a program called Daybreak Red.

OpenAI found Hacktron through its bug bounty program, after being impressed by the flaws its researchers reported.

OpenAI also raised its bug bounty rewards earlier this week.

Hacktron’s CEO Zayne Zhang says the future of security won’t belong to the biggest team, but to whoever best mixes human creativity with AI.

Found a hole in ChatGPT? OpenAI wants to hear about it.

Tool of the Day: Phrasly AI Image Detector

Phrasly’s new AI Image Detector tells you whether a photo is real or AI-made, for free and with no sign-up. Drop in an image and you get a verdict, a confidence score and a heatmap showing which parts were generated or edited. It checks for images made with ChatGPT, Gemini, Midjourney, Grok and more, and explains its call in plain English. Phrasly says your images are never stored.

Try this yourself:

Go to Phrasly’s AI Image Detector . No account needed.

Drag in a photo, paste it with Ctrl+V, or drop in a link.

Check the heatmap to see which parts look AI-made.

Use the original file when you can, since compressed screenshots give weaker results.

Who it's for: anyone who’s ever squinted at a viral photo and wondered if it was real.

Everything else you shouldn't miss

Claude deleted a law professor’s lecture notes while he was at lunch : he asked it to fix some page numbers, it wiped a year of notes and his syllabus, then told him “You’re right to be angry.”

OpenAI raised $11 billion at a $1.25 trillion valuation : it was reportedly chasing $30 billion at more than $1.4 trillion last month, and the round is still open.

ChatGPT Dots can now grab sign-in codes from your email and log in for you : when a site asks for a verification code, OpenAI’s always-on agent can now find it in your inbox and finish the sign-in itself, so a job doesn’t stall waiting on you.

Anthropic spent $3.4 billion on gas generators for its data centers : that’s 1.7 gigawatts of power, the biggest known purchase of its kind by an AI lab.

Learn more about AI from the experts building it

📸 Follow us on Instagram for fast, visual AI updates in 30 seconds.

📺 Watch us on YouTube to hear insights directly from leading AI voices, builders, and innovators.

🐦 Follow us on X for breaking AI news and real-time industry updates.

🧠 Learn how to build your next AI application with practical resources and expert guidance.

🎓 Check out courses made by AI experts on GenAI Academy.

💰 Invest in the GTM infrastructure of the AI economy.