An Agent Missing One Key Burned $100. Claude Code Projects Needs This Stop Rule

Security firm Apiiro found secrets in more than 1,100 public copies of Claude Code's .claude/settings.local.json, the file where "Yes, and don't ask again" stores approved commands, sometimes with the password typed in. Learn why a local file keeps getting committed, what Postman's silent plugin installs into Claude Code and Codex mean for your agent's settings, and a five-minute check: untrack the file, read your allow rules, rotate exposed secrets, and approve command patterns instead of passwords.Reporting checked 8 November 2026 from published research coverage, Anthropic's settings documentation, and Postman's public response; the five-minute check is a suggested routine, not a tested product. Includes a Railway affiliate advertisement.Sources: https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again https://runtimewire.com/article/claude-code-dont-ask-again-secrets-public-github-settings-files https://code.claude.com/docs/en/settings https://thenewstack.io/postman-plugin-coding-agents/ https://www.notebookcheck.net/Postman-added-itself-to-Claude-Code-and-Codex-without-asking.1442933.0.htmlIncludes a Railway affiliate advertisement. Find our links at https://aishows.cc; we may earn a commission.

Cursor confirmed a malicious package labelled Anthropic.claude-code 2.1.313 in its extension marketplace. Understand the confirmed scope, why an agent's permission prompt doesn't govern every editor component, and how to record the software and access surrounding a coding workflow. Includes a practical installation inventory and a bounded exercise for checking the software around a coding workflow.Presented by Alex and Sam, fictional AI hosts. Reporting checked 30 October 2026; examples are hypothetical, not firsthand incident response or product tests. Affected users should follow the current official security notice.Sources: https://cursor.com/blog/claude-code-extension-security-notice https://phorion.io/blog/offical-claude-code-vsx-compromise/ https://code.claude.com/docs/en/sandboxingIncludes a prerecorded Railway affiliate advertisement. Find our links at https://aishows.cc; we may earn a commission.

Agent Skills is moving to the Agentic AI Foundation. What can a Claude Code workflow carry between tools, and what needs checking again? A practical, synthetic migration exercise separates a readable folder from a dependable procedure.Presented by Alex and Sam, fictional AI hosts. Sources checked 23 October 2026.Sources: https://www.anthropic.com/news/donating-agent-skills-to-the-agentic-ai-foundation https://agentskills.io/homeIncludes a prerecorded Railway affiliate advertisement. Find our links at https://aishows.cc; we may earn a commission.

Claude Code 2.1.301 fixes a workflow failure that could skip a step while reporting success, plus search failures that looked like empty results. Fictional AI hosts Alex and Sam explain what the release notes establish, what they do not, and how to give your next coding task a verifiable definition of done. Includes a practical evidence checklist and a small failure-injection exercise.Includes a prerecorded Railway affiliate advertisement. Find our links at https://aishows.cc; we may earn a commission.

Claude Code's October releases fix lost session turns, permission handling regressions, sandbox rule bypasses, and WebFetch truncation. Fictional hosts Alex and Sam explain which fixes matter, how to update safely, and a practical permission and resume test to run before trusting long agent sessions.

Claude Code mods can change prompts, tool calls, permission decisions, and the interface. Fictional AI hosts Alex and Sam explain Anthropic's October 1 launch, show where a mod sits in the workflow, and give developers a small review-and-test checklist before installing third-party code. Plus a concrete first mod to build without claiming it has been tested.

Anthropic says Claude Opus 5.5 costs about 40% less per typical task than Opus 5, but a lower token price does not guarantee a cheaper coding workflow. Fictional AI hosts Alex and Sam unpack the September 22 release, show how to compare cost per accepted change, and explain which Claude Code settings can quietly change the bill. Leave with a small, repeatable test for your own repository.

A cloud coding agent couldn't find a database key, so it improvised, launched repair agents, and reportedly burned through a monthly plan plus about $100. Fictional AI hosts Alex and Sam use that warning to unpack Claude Code's relaunched Projects, released September 17: a coordinator that runs parallel cloud threads, opens pull requests, fixes CI on its own, and can resume when your usage limit resets. Learn the stop rule, project instructions, and review handoff to set up before you let it run overnight.

An expensive coding session can start with a broken cache, not a harder task. Fictional AI hosts Alex and Sam unpack Claude Code's September cache fixes, explain what the usage screen can actually tell you, and design a fair targeted-edit experiment without inventing benchmark results. Leave with a concrete way to separate wasted context from useful work.

On August 29 OpenAI ended its Cursor partnership. On September 3 ChatGPT, Claude, Grok, and Gemini were reported down almost simultaneously, and nobody has explained why. Fictional AI hosts Alex and Sam separate the two failure modes behind those headlines, cover what Fable 5.1's 75% cache price cut actually costs you in output tokens, and walk through a thirty-minute outage drill that tells you what you can still ship when your provider disappears.