Tech news, 9 November 2026: secrets in Claude Code settings files, AI buyers squeeze chip supply, Fortinet advisories due and Anthropic's IPO timing

1. Claude Code's "don't ask again" file has leaked secrets to public GitHub

Security firm Apiiro reported that choosing "Yes, and don't ask again" in Claude Code can save the approved command, including any password or key in it, to .claude/settings.local.json in the project, and that copies of this file had been committed to public GitHub repositories¹. The Hacker News reports Apiiro found real credentials in 1,122 of the public copies it examined¹. Apiiro advises searching repositories and their history for these files, removing them from tracking and adding them to each repository's .gitignore².

CTO take: AI coding tools create new files on developers' machines, and some of them hold secrets. Search your organisation's repositories and history for .claude/ settings files today, rotate anything found, and add agent configuration paths to a shared .gitignore template and to your secret scanning rules. More broadly, keep credentials out of commands entirely: agents should get access through short-lived tokens, not pasted keys. See AI coding policy for engineering teams and the machine and agent identity case study.

2. Microchip says AI customers are crowding out chip supply

Microchip Technology's shares fell sharply after its quarterly results on 6 November, and its CEO told investors that AI customers had taken over supplier capacity, Yahoo Finance reports³. TIKR reports lead times for standard parts have stretched well beyond their usual range⁴.

CTO take: the AI build-out is now competing for ordinary components, not just GPUs and memory. If you build hardware, from IoT devices to industrial equipment, check lead times for your bill of materials now, qualify second sources and hold buffer stock for critical parts. Software-only teams will feel it through slower delivery of servers and network equipment. See the AI memory squeeze.

3. Fortinet's advisories for critical fixes arrive on 10 November

Fortinet released fixes for critical and high-severity flaws in FortiOS, FortiManager, FortiAnalyzer and other products in October, and said full advisories would follow on 10 November⁶. Belgium's Centre for Cybersecurity has urged organisations to patch immediately⁵.

CTO take: once advisories are public, attackers can compare patched and unpatched versions quickly. Any Fortinet device still unpatched on Tuesday, especially one facing the internet, should be treated as urgent. Confirm versions across every site, including branch offices and devices managed by partners.

4. Investors question the timing and price of Anthropic's IPO

Reuters reported that potential investors doubted Anthropic could hold its roadshow in time for a November listing and saw the discussed $1.5 trillion valuation as the high end, partly because of the tech stock selloff; Anthropic declined to comment⁷. Yahoo Finance reports similar investor pushback on price⁸.

CTO take: for customers, an AI provider's listing date matters less than its long-term ability to fund capacity and keep prices stable. Whichever providers you use, avoid depending on one for everything, keep contracts flexible and keep the ability to route work elsewhere; see model routing.

What I'd do this week

• Search repositories and git history for .claude/settings.local.json and similar agent files; rotate any secrets found.
• Add agent configuration paths to .gitignore templates and secret scanning.
• Patch every Fortinet device before the 10 November advisories.
• Check component lead times for any hardware on your roadmap.

I am based in India, the United States and the UAE, working globally. See where I work, or analyse your challenge and bring the result to a call.