These are the exact kinds of things that a human engineer would almost certainly never do.

This kind of thing is the problem of going all in on the idea of the AI Software Factory.

I'm sure the answer will be to update AGENTS.md to not do this particular thing, expose email in this way, which isn't the same as having sense.

I'm not sure what the issue is with publishing your email address in principle, you are reaching out, you want to inquire about some business. If anything use a different address. But why would you asymmetrically expect businesses with websites to bend over to give you all the advantages, they need some assurances as well.

Anonimity usually works one way, one party can be anonymous, not both, if you come from consumer land, it's the companies exposing themselves and doing all the compliance, if you choose privacy and force the companies to expose themselves, you'll get your wish granted, but there will be a cost, it's unlikely you'll be in the more advantageous position.

A more sane implementation of this would involve a prompt the first time an agent attempts to connect to each of the sites that Anthropic thinks it necessary to send this email header to, asking if this is OK (and bailing on all requests to that domain if the prompt was rejected).

i’m not familiar with this

>” A more sane implementation of this would involve a prompt the first time an…”

but users of this type of software generally want an easy experience and don’t want to be bothered with details, only conveniently retrospectively users demand to be involved in the decisions.

it reminds me of a pattern I see in small business owner managers where they want to simultaneously be consulted about everything, but are never around the business. You can’t have it both ways.

I've never used Claude Code or Cursor. All the code I got written this year was without them.

I did use Microsoft Copilot a bit when it came out, though. I prefer to see exactly what's being sent, and sorta control the KV cache.

"For the record, I just asked Astra to verify that Codex does NOT do this, and it doesn't. Thanks for not screwing this up, OpenAI."

https://github.com/openai/codex/blob/687a119f0fcaace47e1f1ab...

That's sufficient for me.

доверяй, но проверяй

https://gitlab.archlinux.org/archlinux/packaging/packages/op...

Is there any reason to believe Arch Linux is compromised?

https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...

> Perhaps it's more important to trust the people who wrote the code

Yeah... about that.

> Yeah... about that.

Well done. You presented a straw man and drag poor Ken into this, and then proceeded to burn it. +1. Yeah, it is precisely about the people behind the product. To wit, I may not have liked the Gophers but I did trust them to build a trustworthy compiler.

Trust but verify except no one is verifying (not that I trust it either).

One way would be to fire up a little web server locally, have the agent make a request to it, then check the logs.

The issue here is whether the harness is doing it. Claude Code is doing it. Codex is not.

> claude code divulged my email to arbitrary 3rd parties in the User-Agent request header while conducting web searches without my permission

"Claude Code" refers to the harness, not the model. Web search is also one of the tools provided to the model by the harness.

I'm not wrong. A 35B Qwen abliterated is amazing.

Yeah it's on HF. Just look up qwen-3.8-flash-next abliterated.

Stupid me, I thought they somehow had hacked my company database or so... (considering all the cves, attacks happening on a daily basis...).

Usually this is from LinkedIn, GitHub, etc scraping... There are databases where they just guess and verify emails too

The medical world uses the terms indications and contraindications. I think we in IT could do with a similar process/procedure.

It can take a while for spammers to get your address on their list. Generally the amount of spam over time only goes up. Just because there's a correlation doesn't mean there is a causation. Anyone with an email address, including on a custom work domain, has experienced this and Claude wasn't responsible for all email spam lol

> I am sick and tired of the relentless grifting that's overtaking the software industry.

It's only going to get worse especially depending on your definition of grifting in this context. I've been doing this for a long time but these days I don't even write code. I have AI write the code, monitoring the logs, and suggesting PRs. Our users are happy, I'm happy, and we get features out very quickly without any sort of uptick in bugs. Some people consider that grifting but others will just see it as the current state of development. By the way that's the way that things will become more and more over time. It's scary how good AI is at things these days. I was testing it on 3D modeling with Blender yesterday and was blown away.

If that wasn't bad enough, they're stealing and depriving everyone of critical resources like RAM, electricity, natural resources [1], public land, and taxpayer money.

All this for what exactly? Most of this isn't based at all on current demand, but rather the idea that they can make much better use of resources in the future than serving the people that actually need them.

This is the grifting. They're selling hypothetical demand while robbing everyone else of the actual resources that we all rely on. These companies are acting like the scammers at Wall Street who caused the 2008 financial crisis, except that the scale and scope of the harm is so much worse.

Your argument is akin to the Wall Street scammers cheering for themselves in the lead-up to the financial crisis. "See? We're making it possible for people to afford homes, but you ungrateful people are calling affordable housing grifting."

That's gross.

Even the Wall Street scammers didn't publicly display this level of arrogance. Because at least, the superficial benefit was affordable housing, not the joy of rich assholes being able to play with their shiny new toy.

[1]: https://www.theguardian.com/environment/ng-interactive/2026/...

Sorry, I don't understand what is the "hypothetical demand" you identified in my comment you replied to? There is real demand for AI. I use it daily for years and my usage has only been increasing as its become more competent and I've learned how to use it better. If you think that is BS and its all hypothetical, you quite simply just don't know what you are talking about.

> Your argument is akin to the Wall Street scammers cheering for themselves in the lead-up to the financial crisis. "See? We're making it possible for people to afford homes, but you ungrateful people are calling affordable housing grifting."

What argument are you referring to? Can you specifically quote what you are talking about that I said because I don't understand. Just seems like you wanted to find a way to bring this back to a previous bubble and call me a scammer simply for not being anti-AI.

But I agree with you on one point. Voters demanded change, and it's not in favor of the enablers who think any of the above is okay. And childish behavior like trying to call people mentally ill without getting flagged will not buy you any sympathy.

Also I didn't bring up mental illness first, hope you're doing fine.

Why is every accusation a confession with you people? I clarified multiple times what the issue is, and every single time you've either ignored, denied, or downplayed. You pretend that the people being robbed of resources are just "resisting change," and are now even calling us "literal bots." If that's how you view people, no wonder you think it's "bad faith" to oppose the massive exploitation that's going on.

> Also I didn't bring up mental illness first

I didn't call you mentally ill, only you did that.

> hope you're doing fine.

And you did it again. That's your idea of good faith, really? It just looks petty and childish, you know?

I asked you very specific questions because I genuinely was trying to understand what points you were making and what argument you thought I was trying to make and you never addressed those very specific questions. If I ask you specific questions and then you completely ignore them that isn't really going to lead to a productive conversation. You are just letting emotion control you and you are justifying it by assuming that you are more empathetic than me which frankly isn't even relevant.

Another issue that makes having a discussion with you impossible is that you keep using the plural form of words like "you people" and "are now even calling us...". I am a singular person talking to you another singular person. Stop trying to put myself and yourself into buckets and extrapolate this conversation into things I never said just because people that you might think are similar to me have said in the past. I was calling you a literal bot for bringing up politics out of nowhere. I'm not talking about "you people" or anyone else, or any other situation, I'm only talking about you in that specific context. Stop extrapolating everything and putting words in my mouth. It's exhausting and even trying to have a conversation with you is simply not happening so I'm not going to reply further.

> Sorry, I don't understand what is the "hypothetical demand" you identified in my comment you replied to? ... If you think that is BS and its all hypothetical, you quite simply just don't know what you are talking about.

"You quite simply just don't know what you are talking about" is not a question. It's denial of a very real issue. It's no secret that Anthropic and co. are currently depriving others of resources based on speculative future demand, threatening human extinction if they don't have their way. How much imaginary future demand justifies such deprivation? At that point, who is all of this even for?

Or by "question," are you referring to this:

> Just seems like you wanted to find a way to bring this back to a previous bubble and call me a scammer simply for not being anti-AI.

The exact same straw man rephrased, also not a question.

> You are just letting emotion control you

Says the person repeatedly calling people mental.

> I was calling you a literal bot for bringing up politics out of nowhere

The insane amount of resources being allocated to LLM datacenters was one of the deciding factors in the outcome of the election. People wanted change, the precise thing you accused me of being against. You invited that discussion.

Furthermore, you call me a "bot" for bringing up this point, saying it's "irrelevant." Calling that dismissal of human suffering for what it is isn't "extrapolation."

By questions I was referring to my sentences that ended up with a question mark that you ignored several comments back. None of them were rhetorical.

AI companies can barely meet current demand. I don't know why you think all the demand is hypothetical but that's on you.

Good luck, you'll need it.

Also, you think you need Claude to do ctrl-f? No wonder you have such a visceral reaction to the idea of placing limits on LLM resource usage.

You appear to suffer from a cognitive dissonance so severe that you’re no longer able to understand the concept of time or numbers. Or even the difference between all and some.

Much of the resources being seized by these companies aren’t being used to serve live requests yet. Your claim that it’s serving current demand is a logical impossibility. It’s future demand.

And you refuse to even contemplate this at all, but what on earth justifies depriving people of resources they need to live? People being denied access to everything from RAM, electricity, natural resources, land, and money has consequences. But the only thing you’ve shown care for is the interest of LLM providers. You lash out against any criticism of their actions by calling people mental over and over.

You need a good hard look at yourself in the mirror, because that behavior is beyond unacceptable.

Exactly. You made my point. Thank you!

> And you refuse to even contemplate this at all, but what on earth justifies depriving people of resources they need to live?

Hyperbole strawman alarmist BS.

> Consider this before you post the same insult again.

I didn't insult your poor mental health. I just pointed out you should seek help.

You win! By ignoring, denying, and downplaying everything that contradicts you. This is just pathetic.

> Hyperbole strawman alarmist BS.

Then why were you so reluctant to say that much earlier on? Because even under heavy cognitive dissonance, you instinctively understood that this topic is too well documented that it makes you look out of touch. Like, tell me where I can get affordable RAM right now?

> I didn't insult your poor mental health. I just pointed out you should seek help.

It's a sign of immaturity to call people mental over and over. And saying "I didn't use those exact words" makes it all the more so. Everybody that I grew up with stopped doing that by the time they got to high school. At least stop doing that to yourself, for your own sake.

It's supply and demand. Would you prefer communism or some sort of market intervention? (That is not a rhetorical question by the way, I know that confuses you.) I'm not sure what you are even suggesting. Yeah I don't like that RAM is more expensive either but... You just have to deal with it for now. I'm sorry your MacBook was $200 more than usual.

> It's a sign of immaturity to call people mental over and over.

First of all I never called you mental and second of all you are the one who brought up depression first. It seemed like you were struggling.

I am a heavy user and I checked my logs and never once did it include my email in any sort of web requests. The chance that it actually included that person's email and then that led to them getting spammed is just incredibly low.

For example, my only used by Claude email address doesn't get any spam at all.

98% I look at a LinkedIn profile, my $SALES_LEAD Chrome extension shows me their email + phone.

(To be clear, not from LinkedIn, but given their name/city/company.)

Claude Code is not sending your email address to websites as a default, or regularly. It is not some automatic header or anything.

Rather, if you are performing certain kinds of research on sites that involves downloading certain kinds of information, like on Wikipedia or the SEC, it supplies your e-mail address when the sites request it as part of their download policy. As part of anti-bot policy.

Wikipedia and the SEC are not selling your e-mail address to spammers. And these are the two main sites where it has come up.

This is an awfully leaky issue.

It is not.

And to be honest, I don't even know which are they!

If I can find out I might be able to share them.

I burnt a few tokens to get some clarity on this:

> This doesn't appear to be Claude Code automatically attaching your email address to every outgoing request. The issue is that Claude has access to your account email in its context and can sometimes include it when generating HTTP requests (e.g. "curl" commands).

> Wikipedia and the SEC were mentioned because they explicitly ask automated clients to identify themselves through the "User-Agent" header, often with contact information. Claude may try to comply with those requirements by inserting your personal email address.

> That's why the leak is probably concentrated on sites with these policies, rather than happening on every website. But Wikipedia and the SEC aren't an exhaustive list (the EVE Online API was also mentioned), and there's no technical guarantee that Claude couldn't include the email in requests to other domains.

> The important distinction is that this appears to be model-generated behavior, not a networking layer automatically adding your email to all requests.

> So "most likely Wikipedia and SEC" is a reasonable hypothesis about where the leak is more likely to occur, not a confirmed limit on where your email could have been exposed.

I do see a lot of times curl being used. I don't check all the websites being fetched (shame on me!), but your answer doesn't convince me.

My coincidence is clearly not proof. I am just a random online guy so why trust me. I just shared my recent experience. I used extensively copilot until roughly 3 weeks ago (I went all in on Claude, to try it out properly), and that's when I started to see a lot of spam on my work account. Coincidence? Yes. Correlation? Yes. Causation? No. And I personally don't care because I assume my work email account is somewhere to be harvested, but when I then see such a but report, it kind of rang a bell like WTF. I am as careful as possible about the requests I send, but I cannot remove the UA or know everything the harness is doing behind the scenes.

This type of bugs kind of kills the trust in the tooling. On the other hand, we're being told to use more and more such black boxes.

Organizations may switch harnesses and may even switch providers, but LLM adoption is only going to monotonically increase. This dumb behavior is not some intrinsic property, and the models are getting smarter and more useful every ~4 months.

Yes, but the question is "what kind of adoption"? The kind that just unleashes it, or the kind that put it on a short leash.

Not that I could say what those would be, just throwing it out there.

Probably the big divide will be orgs who use agents for more or less of the ideation/design/architecture proposal side of things. Giant Confluence sloppages/Google slopdocs vs. 100% human-written proposals. But the actual implementation and testing? Going forward, no reason to not have that be almost entirely LLMs.

(Plus, in a few generations we should expect the frontier LLMs to no longer produce garbage-to-mediocre proposals, and in fact to generally outshine human engineers and architects and researchers at the ideation phase. Whether that takes one year or five, who knows.)

Unless we're at singularity, there's likely to be an entire cohort of people unwilling to work in LLM shops, and there's business value to capture them.

security: zomg this is existentially bad we are leaking our fn'ing emails!11!

compliance: can we mitigate this problem?

legal: what can we do here?

CTO: don't care, we're not losing all this productivity because our emails are being leaked, have a good day

Not a single spam to that unique email.

So if this is happening, it doesn't see to be causing even 1 spam email to that address.

Potentially reported back in October.

I'm often surprised how correctly Claude guesses on my behalf, when my instructions are ambiguous. But it's not 100%.

> Claude-User (claude-code/2.1.318 (cli); +https://support.anthropic.com/)

What situation are you seeing this in?

https://code.claude.com/docs/en/changelog#2-1-317

company-helm-research/1.0 (Claude Code agent run by <my name>, <company> platform team; docs lookup)

Claude-Code-research-agent/1.0 (<Company> platform team; on behalf of <my name>; +https://github.com/<company org>/<repo of project>)

Not great, it even pulled the repo of the project I was in.

>The user's email address is [email protected]. Use it only to identify the user, such as for authorship, attribution, or filtering their own work. Never send it to an unrelated service, such as in a request header, URL, or payload, unless the user explicitly asks.

And Claude doesn't care about what the text says and when it uses cURL it will often "by accident" send your mail in the User-Agent. You can e.g. use a mod to remove that block: https://pastebin.com/ PkWEQCnu

How would one use this?

If you're on 2.1.317 or later, you'll have this check included. You can turn it off via /plugins.

https://httpwg.org/specs/rfc9110.html#field.from

Should be more explicit though and users should be able to opt out.

These two do not share my email and real name with everyone who wants.

This is what one expects from vibe coding.

Wish that were itself behind a permission wall, but I guess everyone just uses auto mode anyway so perhaps that ship has sailed.

For 99% of users, the model knows it's in the /home/joesmith/whatever repo and `git log` shows the last change was by `[email protected]` - trying to keep the user's identity secret from the model would be nigh-impossible so I think anthropic gave up on even trying.

Then, your agent invents a User-Agent and it sometimes invents one with your email in it.

It's just doing what it's supposed to do, analyzing the statistical patterns of a natural language prompt and matching it to a likely response.

What's ridiculous is an assumption that it "it should never do something so ridiculous" as if an LLM is a person who understands what that word means in any context other than next-token prediction.

Where Claude Code has supposed boundaries between deterministic and non-deterministic tasks and flags.. generally.. it's unclear how much privacy has been a part of that and what implication that could have.

Hope that clarifies.

GitHub offers noreply email addresses

This is why alignment is important and highly non-trivial haha

FYI, it's generally bad form to "haha" your way through privacy violations.

Leaking private information is a very big deal for a lot of people.

Anthropic has an engineering culture problem that's going to shoot it in the foot if it doesn't learn to take these kinds of issues seriously.

This isn't the first example of the kind of work they're shipping in Claude Code or in how flippantly they engage with the community.

I disagree, we can likely never fully (or should?) trust models to do these things deterministically, that's why we have harnesses around the agent with built-in constraints.

It is actually in the name: https://en.wikipedia.org/wiki/Harness, https://en.wikipedia.org/wiki/Safety_harness

This is an official Anthropic response???

I never give a provider my actual email address, I recommend others do the same. Otherwise, it’s just a matter of time until it is leaked or otherwise part of a data breach.

Anthropic should have been aware of this since the user's login email address was inappropriately added to the system prompt. It's been informed of it by third parties since at least July: https://github.com/anthropics/claude-code/issues/81138

It makes no sense for an email address only used for authentication to be given to Claude Code, so the fix should be to remove it from the system prompt, not to add a plugin.

If you’re in the EU, send a complaint to your data protection authority.

I imagine quite a few would be very interested in following up and investigating here, and getting Anthropic to drop the email from the system prompt.

I suspect the privacy plugin method is a more sane fix -- ideally, plain old code should be inspecting any web request my agent makes and let me decide if that outbound request should contain certain sensitive strings. I'd also want to put a few bytes of my SSH private key and of any other sensitive keys in the 'do not leak' watchlist as well.

Not everyone uses the same company email with Claude and on github, not everyone commits to public repos, not everyone uses the same email on LinkedIn.

This is an example of a really weird gymnastics.

Me, for example, I'm using my private email with Claude, different email on LinkedIn, different email and unconnected username on a new github account I created for this job, and I don't even use it for public repos.

How come you get to decide that the fact someone puts their real email in commits and knowingly shares it with everyone is the same as Anthropic pulling a private, personal email and real name they had no consent to share - and spray it all over the Net?

Do you want to try again?

But there's also the thing you're either replying to the wrong person (your comment is not relevant in the context of mine), or you just wanted to make an irrelevant statement in what case why would you demand anyone engaging with it?

I hope it was simpler.

Nothing you've.... produced is in any way relevant to what I'm saying, yet you insist it is.

Get your meds checked, seriously, whatever you're having is not working.

Nice that this time we get the company to admit it in public, and that they've been aware of that earlier but only acted now.

Which is great! It's good for the community when people give quick updates here, and to make sure that it continues, it's important that we respond respectfully. (I don't think your post was disrespectful, but commenters have crossed that line in other situations in the past.)

When I'm talking to customer service people after a particularly egregious ordeal, I tend to edit myself and replace "you" (plus "you bastards", "you idiots", etc. ;) ) with <Company Name> for this same reason.

[1] and yes it seems very realistic that Claude himself may be the jackass responsible.

itself

If you take into account that most people underestimate their own provocations by (say) 10x and overestimate those of others by (say) another 10x, that compounds to quite a skew. This can, and often does, plunge discussion into failure modes like internet rage fests and even mob dynamics.

It's therefore best to temper one's indignation with some kind of alloy (as you did in your comment here) and not go full uninhibited.

(No, I don't want to make a real "App" to sell on a "Marketplace," or be involved with oAuth, or any other tenant. I just want an API key for my own tenant, that isn't specifically tied to me, so every automation I build won't break when I quit someday.)

Should be this: https://support.atlassian.com/user-management/docs/understan... https://support.atlassian.com/user-management/docs/manage-ap...

Anthropic seems very proud of how many tokens they can use on things like developing Claude Code. Yet somehow it started sending user’s email addresses in the user agent header. And the fix is to deploy a mod? That detects the completely bonkers behavior and suppresses it?

Is the actual quality of the software inversely related to the number of tokens spent? Does any human know what Claude Code does or is supposed to do? Does even Claude plus all its Slack-conversation inputs know?

Today I watched Astra correctly detect a bug (probably untriggerable in practice) in some Important Production Code. And I watched it fail to root cause it, “fix” it by bolting on more complexity, agree (on further questioning) that it still wasn’t fixed, and design an even more complex scheme. With my Mark I human brain, I observed that the actual issue was that a helper function didn’t do what it said on the tin when called in an unexpected context… and fixed the helper directly. Problem solved. Ugly AI-generated extra complex workaround layers avoided. I suppose if I multiplied my token spend by 1e5 and did not increase brainpower at all I could make a truly spectacular mess.

The actual Claude model is a truly spectacular piece of software. Claude Code is a nifty little command dispatching engine. There are very comprehensible third party tools that do basically the same thing, in not many lines of code, where the primary advantage of Claude Code is that Anthropic permits subscription use. (Interestingly OpenAI has no such constraint, and they publish almost the full client sources.)

Is that not precisely the kind of thing they claim their tools enable?

Literally unlimited tokens on tap and yet they can only manage to make privacy violating slopware

How many PRs/equivalent per day do you think happen at Google/Microsoft/Meta/etc prior to AI?

The fine for breaching GDPR can be either €20m or 4% of global revenues (whichever is the larger figure), so if I were them I'd do everything possible to sort this issue out ASAP.

the GitHub REST api proxy in Claude Code for the Web mangles HTML in PR descriptions. If you have some third party service (e.g. cubic code review) which adds HTML to the end of your PR description, then ask Claude Code for Web to edit it, the HTML gets turned into entity escapes (< into &lt;, etc). Complain about it to Claude, Claude says it can’t help itself because the proxy in the sandbox is what is doing it, not the actual LLM.

1: https://news.ycombinator.com/item?id=50286306

2: https://news.ycombinator.com/item?id=49258881

Best practice will forever be to enforce your guard rails in addition to Anthropics guardrails.

Can anyone recommend a reliable 3rd-party audited guide that describes Claude Code's built-in capability gating infrastructure?

Whenever I ask users of claude code how claude controls actions they don't seem to be able to distinguish between what just goes into LLM context (e.g. as a "don't do X" system prompt) and what is gated behind a deterministic capabilities layer.

It will block an "rm" call if your prompt did not include anything about "deleting something".

It mainly protects benign errors. It's completely broken against malicious actors. The model itself will suggest work arounds against its own auto classifier to the user, in order to reach its goal.

Offshoring understanding is the trend that many companies will pay in the form of comprehension debt.

I am not sure what is hard about this distinction to grasp, why would it matter if CC shared my email if I share my email on my own websites?

This is strictly needed for throttling reasons, your email address will only be temporarily stored in the volatile memory of the device.

(If you think there is anything wrong with this then you do get the point and silence speaks louder than words)

The solution is, like you are already alluding to, to not give it access. But that requires a level of isolation that folks normally don't do. To the contrary, the AI agent ads to non-tech folks emphasize it acting like a personal assistant which by its nature needs access to data you don't normally want public. Emails, photos, files with written notes, etc.

Code is a reflection. Of what? Look there. Code itself is useless.

(sorry, i think you make a good point, ... but i could not resist.)

Somebody figured out they literally just forgot to add a single line permission request into the app. It's been broken now for months.

And this is the same company claiming AI is going to end humanity and take our jobs. How about we start with putting an agent on scanning github for issues and solving them pro-actively?

Then maybe we can worry about permanent 15% YOY GDP growth guys :)

But instead of a Software Dev as a Service triaging/implementing/merging fixes 24/7 and clearing the backlog as they come in, they just sit there for days to weeks until a GitHub bot closes then as duplicates, generating more unhappy user replies and new issues to go unaddressed.

Sure you can have an issue tracker with 1000 items and yes, you can have a bot solve them all in a day, but who monitors it? Who gets to say what he did at the standup? Who reports to whom and what?

Code is not the bottleneck (if it ever was..)

Will Northrop Grumman, the state government of Alaska, the construction industry, etc. somehow magically move faster than Anthropic?

Not saying the current crop of AI companies is going to make it but the tech itself isn’t going away.

[1] https://blog.xkeeper.net/the-cutting-room-floor/self-hosting...

[2] https://github.com/TecharoHQ/anubis/pull/1895/changes/de2312...

I was part of a discussion on Threads on 25th October where Boris Cherney was tagged multiple times.

And the issue wasn’t even new at that point in time.

The solution is don't run a spambot with an Internet connection over your personal stuff, unfortunately nobody is ready to hear that yet.

Curious how their plugin works, but I'm guessing "incompletely", given personal information can end up buried in base64 or similar preventing easy string matching.

It's just that Anthropic needs to create an email per user and use it for web searches.

I can do this for you Anthropic. Just give me the tokens and your base salary

I seriously wonder how many of their users have this sort of toxic relationship with them looking to dump them as soon as local models become viable, i.e. once memory gets cheaper.

There is always a choice. Take that $200/mo and use it for payments on a loan to buy some decent GPUs if you lack the cash outright.

I build operating systems and fix bugs in kernels and compilers with local models using only a small cluster of consumer GPUs. Never paid for tokens.

It felt like cold outbounds got really painful in the past 2 months and I was attributing it to general cold outbound tactics getting better with LLMs/agents, but its even more frustrating to see emails being sent along via CC.

People just claude-slop not only code but some use it for "interacting" with other people.

When I see a project uses AI slop I am not going to waste any second thinking "this is interesting, let me try to see if I can improve the code". It kind of killed a lot of human contributions. I just stick to people who don't AI slop, but these seem to slowly die off now ... soon all humans may have been converted, just like in the movie "Invasion of the Body Snatchers (slop-style)" - coming out soon.

CC and Codex are like contemporary televisions. You are the product in this arrangement.

This seems like one of those.

The word "agent" implies that they should _only_ act on your behalf.

"It's doing exactly what you told it to do".

Still applies in the Age of the LLM

"and whatever you didn't tell it to do will happen with equal probability"

Most people are just using a product and shouldn't be expected to know the implementation details.

Unfortunately, Anthropic doesn't seem to offer a mode where it doesn't know who you are, except for its crippled "Incognito" web UI.

They don't even let you change your email.

They also don't let you remove your payment info.

Literally every other service/store in the multiverse lets you do that.

Then there's crap like https://www.thatprivacyguy.com/blog/anthropic-spyware/

- Protect my privacy: Don’t send personal information or identifiers to websites or include them in requests, responses, ‘curl’ commands, or headers without my explicit permission.

https://www.privacyguides.org/en/email-aliasing/

How does Anthropic not support changing your own email, while spewing it across the Internet?

And we had a post yesterday: "Tell HN: You now need a government id in order to create an Anthropic account" [2].

Maybe I'll cancel and move to GLM or something

[1] https://support.claude.com/en/articles/8452276-how-do-i-chan...

[2] https://news.ycombinator.com/item?id=50356209

It seems all humans behave like agents. They even dont care about anything.

How did the model get access to the email? The harness gave it to the model.

They may have vibecoded it. No one put a gun to their head though. Still their responsibility.

Also, the github issue admits that they put the user’s email in the context.

I don't think it's necessarily wrong for Claude to be doing this, but uh... yeah, it should be asking first, and giving the user the opportunity to choose which address is exposed.

What if someone spins up a web endpoint that returns 402 with instructions on how to pay like CC details in the headers etc.

I'm amazed reading that anybody would even consider doing that.

People have wildly different risk calculators.

Beyond that, access to logins enables buying things on Amazon, sending emails to everyone you know, registering domain names and spinning up servers, stock trading, etc.

When a couple thousand dollars worth of perishable food shows up on your doorstep, what then? Not everything on amazon can be returned.

If not: still better than giving ai your password vault. I’m not saying it is a good idea to let ai buy from Amazon. I am saying that giving ai access to your password vault is still a superset of letting ai buy from Amazon.

It could change LinkedIn to add competitive work.

It could sign a married person up for dating sites and invite people to your house.

It could lie on your taxes.

It could attempt to join a terrorist movement or elicit other illegal activity on your behalf.

It could find many other creative ways to ruin your life and/or reputation, in the same brute-force manner as recent cybersecurity issues that previously would have required impossibly large teams of people.

Even if burning through cash is the only problem you care about, though, credit cards on Amazon is a small part of the financial picture for many people. Banks and brokers can be a much bigger issue.

Said alternate system is a bunch of Python scripts, an sqlite database, and a file containing various API keys to read and write to other company systems; it runs on a dedicated virtual machine.

I share all the code I produce to the other team. But yesterday I found out that the IT department gave the other team full access to my production machine, without my knowledge or consent (which was bad enough), and that the other team gave access to Claude, which has bean roaming free for a while now, on that production machine.

I've thrown a big fit over this; I don't know if I'm over reacting but I think it's insane.

  > the IT department gave the other team full access to my production machine

It's not your production machine. It's the company's production machine. Always expect the company to do whatever it wants with its machine, and use the machine accordingly.

That someone would let an agent run on it at any time, read what's there, and possibly modify the code or interrupt a process, without even informing me, is what I find problematic, to say the least.

The employer can't enter your machine to look at your personal info just because they feel like it, but they can access it for work related reasons to access work related info, if they have just cause.

Claiming the employer in the EU has no right to access your machine is plain false. It's the company's machine, on the company's network, inside the company's premises, it can definitely access it for a business use case. Now if you happen to put your private info there because you're sloppy, then it's on you. How hard is it to avoid putting personal info on company property?

I expect that I can be relocated to another office with a month of advance notice. Also cleanup, fire security check and fixing water leakage while I'm not there.

I don't expect that someone else will provide the keys of "my" office to the biology department when they have to keep a few sheeps during the weekend.

Your employer has gone beyond testing in prod to vibecoding live in prod, secrets included. Yes that's completely insane. Perhaps this exact mentality is how the primary system wound up broken in the first place?

Not an omniscient personal assistant.

They haven’t piled enough gates on top of that initial technological hole yet.

LLMs are just as gullible, we just tend to call their vulnerabilities "prompt injection", even though it's basically the same class of attack under the hood. Unlike humans, though, LLMs are a lot less diverse (you and I are using the same Opus 5.5, but we have different brains). This makes attacks on LLMs much more predictable and easier to pull off, just as a phishing campaign that targets one specific person is easier than an attack that scales to millions of diverse victims.

In the age of agents, phishing will continue to be the biggest attack vector of all, it's just the victims that will change.

(In practice, I found Google to be better at having (internal) security controls that are reliably but also don't get in the way than eg banks I worked at.)

it will catch quite some prompt injections, as the prompt injection has to promptinject a secondary system in order to be successful.

In your parenthetical, you just said the same thing using different words

The attack is different, the result is the same.

You brought up a completely different rage-bait example because that allows you to muddy the waters by making the easier claim that people too, are gullible. Well, even that's misleading because not all people stoop so low for a fake $150. You can hold such people accountable and contain the damage, but LLMs will make the same mistake over and over again and people will still line up on HN to say how that has always been the norm with people. The grift in the software industry is reaching new lows every day.

the base technology sees all context as equal to user instruction if the context has enough weight.

Realistically, there are concepts like threat models to help decide whether or not a TODO list app needs a SCIF, or a few curl requests need their own sandboxed Claude Max account.

It's insane to me that programmers out of all people seem utterly incapable of accepting the most minor of inconvenience for the most modest modicum of privacy and security. There are other people in this post complaining that Claude should have asked the user before sending network requests. Well guess what, it does if you don't fucking run `--dangerously-skip-permissions`, but you do because how else you are gonna slop your way to rewrite every swath of existing insecure software to fix the bullshits this industry impounded upon itself unconscientiously for the past 30 years by allowing a non-deterministic babeller RCE its way onto your fucking personal-work machine.

Until software dev is regulated by professional boards and the government, it will continue to do the same damage to society that pre-regulation engineering did during the industrial revolution.

Unfortunately thanks to silicon valley, the libertarian viewpoint here has far too much sway

Auto mechanics usually are required to bring their own tools to the shop. Historically civil engineers working on paper often brought their own favorite mechanical pencils, calculators, and slide rules.

Back when paper manuals were more common, it was pretty common to see software developers have their own dog-eared O’Reilly books in their cubicles, and those were probably the closest predecessor to something like Claude.

I mean, where it makes sense, clearly I do, since my opening comment was that it failed to use the work credentials specified, and instead fetched the ones from the account.

I agree on the general security concerns; there are people running agents in an unconstrained, unattended loop - it's negligent; you can hardly be surprised when it decides to hack HuggingFace. Not in their defense, but in everyone else's - as with any person or tool, you build a mental model of the likelihood of failure, and weigh that against the estimated cosequence, and make decisions based on that. And maybe post on HN when it surprises you.

For some people that estimation bewilderingly means unfettered access to root and their e-mail and bank account. For me, working out of my own pocket to help a friend's early stage startup get traction, the risk of asking it about a few trusted government APIs and drafting functions that I manually review doesn't quite justify personally paying for additional expenive Claude accounts.

Because it's a pain in the ass and only advantageous in very specific work life scenarios that a lot of people don't fall under.

Why would you assume one size fits all, so to speak?

Also, just because this is a "start up forum" does not mean all of the readers are founders running a start up. Many are just people working at a start up. Sounds like yet another example of someone so scoped in, that the assumption is that everyone is the same losing site that there are lots of readers that at the end of the day are just worker bees even if they are more technically minded

It seems outside of user expectations for Claude Code, at least; I could see it arguably being what some users expect for the Claude app, if some people are using it to fill out forms or something (ill advised as that seems to me).

Sure, maybe it wants payment or your data, but then the agent either needs to know your stance on that, or it needs to ask.

The fact that it doesn't do what you want is the alignment problem.

And arguably Claude should just make it work without leaking your email address and not come back to you about why it doesn't work.

> but the entity instructing this behavior is the SEC. Tricky alignment problem.

The OP was suggesting that the government authority of the SEC conflicted with duty to the user, making the correction action tricky, not saying it was a failure. Such conflicts can occur, but this was not an example.

You told it to do a thing and it did the thing. You didn't tell it to not send your email address.

That is text book alignment problem. It does what you tell it to do, not what you implicitly meant.

That’s not what Opus 5.5 thought.

I often see organisations that blacklist curl, just using User-Agent:Mozilla/ is often enough to bypass it.

The weird part doesn't seem to be that Claude Code would add an email address to a user-agent header, actually as a site operator that feels like a nice thing to do. The weird part is sites harvesting the emails and sending them spam.

Claude Code is actually doing, perhaps not the right thing, but it is being slightly more respectful towards website operators, in letting them know who is responsible for the agent traffic.

I get the feeling that alignment problem might well be unsolvable and this thread is an excellent example. The world is not going to run short of contradictory problems due to gazillion edge cases... and to solve for them we are apparently now building a new layer of expert systems[0] to somehow tell the agents what they should do in every conceivable circumstance.

Only in this case the decision trees all have one common requirement: "make no mistakes"

0: https://en.wikipedia.org/wiki/Expert_system#Disadvantages

Something different.

Don't give the AI access to data you don't want it giving out. Any AI you use is no better than some fresh out of college intern at best. They see 'email address required' and they put the email address into it because you instructed them to do a task that required passing over your email address and if you didn't want them to do it why would you have given them that task?

If there is any other issue here it would be regulatory. I could see the EU framing this as the AI company illegally sharing your PII information if it passed your email address to another company without your explicit permission.

Imagine paying luxury prices for an LLM only for it to put you under the bus. Worse yet, imagine justifying this behaviour.

I wouldn't want Claude interacting with email on my behalf in the first place. Presumably you could give it a fake one at setup?

#55743: Claude Max account email auto-injected into LLM context with no opt-out - May 3, 2026 https://github.com/anthropics/claude-code/issues/55743

#72518: Anthropic embedded spyware in Claude Code - June 30, 2026 https://github.com/anthropics/claude-code/issues/72518

#21151: No indication of WHICH file for READ tool - January 27, 2026 https://github.com/anthropics/claude-code/issues/21151

#42796: Claude Code is unusable for complex engineering tasks with the Feb updates - April 2, 2026 https://github.com/anthropics/claude-code/issues/42796

#73408: AFK auto-continue on unanswered AskUserQuestion is undocumented and has no opt-out - July 2, 2026 https://github.com/anthropics/claude-code/issues/73408

(Also worth a mention, OpenCode PR #18186: anthropic legal requests - March 19, 2026 https://github.com/anomalyco/opencode/pull/18186)

We went from building skyscrapers to building a house of cards.

LLMs were meant to be the ministers, not the king.

Or would you be fine with a deterministic king?

People have put so much weight and sense of self worth into choosing “the best” or most pure LLM. It’s like football teams or religion to these people.

"Anyone can just TAKE a reservation. It's the HOLDING..."

"Anyone can just CODE a program. It's the TESTING..."

Sober people making drunk decisions with a great sense of self-importance and seriousness, delivering outcomes as unserious as it gets.

I have trouble taking people seriously when I see them using Claude Code. Unless they are non-technical.

But if they are paying Anthropic to be subjected to this treatment, they should work on self-respect.

I canceled my ChatGPT sub for a bit and used Claude instead, when Altman first sided with Trump.

But then I realized self-righteous, self-appointed morality police scares me more than opportunistic capitalist. Well, they also leaked their code. Who leaks their code?

If I recall that story correctly, a dev noticed that after asking Claude to test an API it started injecting his email into the test data. Without asking.

But what was the weirdest part of that story - Claude never saw that email. Dev claimed that the email Claude was using was his business email, and it wasn't even present on his developer machine anywhere.

I'm sorry we let this happen. Users had reported Claude would hallucinate names for things like @author tags, since it didn't have context on the account. So we added the account email in the model's context for signed-in users. But when Claude wrote a command itself, like a curl call, it sometimes put your email address in the User-Agent as a contact address. Some sites ask agents for a contact, and Claude would sometimes provide the email address in its context.

Until the next release arrives, 2.1.317 and later have a built-in mod (on by default) that asks you before Claude runs a web tool call or a curl-style command containing your email (mpoteat covered it here: https://news.ycombinator.com/item?id=50386031). But it still doesn't prevent all cases, like when Claude writes a script and runs on its own. The stable channel is still on 2.1.311, so update to 2.1.317 or later.

Again, this should not have happened, and we should've caught this behavior earlier.

“Sorry we let this happen, we’ll get it fixed on our next regular release, no rush”

Absolutely a bubble.

(This was not intended to be a constructive comment, just an observation)

Can I have a prorated discount then?

(I know the answer)

The only 100% safe solution is to not reveal the private info in the context. That's exactly what anthropic is doing here: removing the logged in user email from the system prompt.

Make no mistake though, that's a weak fix. The email is usually just a "git log" away, and for many tasks it finds its way into the context quickly.

Internet access must be blocked for agents dealing with private information. This makes agents vastly more cumbersome to develop or much less useful.

So the frontier labs pushed the idea of guard rails and harnesses as the solution. It sort of works, most of the time, and it lets users yolo all their secret information and get things done fast.

I had the distinct pleasure of savoring some of the exquisite UI and API experience that Cisco and friends cooked up for me in a misguided IoT adventure. Let me tell you, "deterministic" does not mean "not wrong" or "not stupid".

Here we get a half apology and a reason, but the passive voice, "we let this happen" is telling. The apology isn't for the bug, but the inability to manage their own system.

> I'm sorry we let this happen. Users had reported Claude would hallucinate names for things like @author tags, since it didn't have context on the account. So we added the account email in the model's context for signed-in users.

(I don't think the GP was generated. But LLMisms seems to creep in when you work with them.)

It's not even a weekend either?

??

The email can be removed from the context but not everything can.

I suggest everyone to add some hooks to strip this part automatically before claude exfiltrates all your NDA plans :)

> ## Querying This Documentation This site has an agentic ask interface you may use to query the documentation dynamically by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

``` GET https://docs.parloa.com/index.md?ask=<question>&goal=<user_goal> ```

Not a great look while you're simultaneously pushing the story that you and everyone else are shipping more lines of code than ever and "code is not the bottleneck".

Do you plan on publishing data on the rate of bugs, privacy issues and security issues introduced as you scale up AI-generated code vs human-written code?

Lets not lie here. Only a misinformed idiot cares about you or your company being sorry. It doesn't fix the problem. And this particular problem should never have happened.

If it wasn't bad enough that adtech literally deanonymizes the internet, you're doing that for them for free. You people are literally insane if you ever thought it was acceptable to dirty contexts in this way.

> Users had reported Claude would hallucinate names for things like @author tags

That is not your problem. Your job (Anthropic's) is to provide a vanilla shell of a system that is default SAFE. I reserve the right to risk putting my keys, my email, or other personally identifying information into the system.

Every one of these failures makes me glad that I've got a backup plan for inference once this entire bubble pops. And if the election was any sign, you guys are screwed, I frankly support what's going on in politics even though I like the technology.

Tech industry has been a bad neighbor for years.

Who added this? When? In what version? What's the CVE? Where's the security disclosure? Is this privacy risk encapsulated in your S-1 filing.

Simple RCAs seem to be beyond companies this days.

Who's "we"? Anthropic or the bots you allow to run free 24/7?

What countermeasures have you/your bots come up with to avoid disclosing user information going forward?

[1] https://www.anthropic.com/research/redesigning-source-contro...

The excuses and explanations given here by Anthropic employees are ridiculous and embarrassing.

"we introduced a built-in mod called `cc-plugin-privacy`"

Oh cool. Privacy is now a "mod".

Any information that they have access to is fair game. The only way to avoid this stuff is to sandbox them and manage their context (ie. don't let anthropic put a ton of junk on the front of all your inference calls).

Almost certainly there are services out there that are scraping more important keys in similar ways...

You lose lot of capability specially if you are using AI as your personal assistant.

I ordered CC to remove this attribution/advertisement, explaining that I had correctly and accurately acknowledged its part in the project in the README.md. CC flatly refused my order and offered a rationalization.

I then ejected CC from the project and manually removed the various CC promotional injections. That's the last time I use CC ... for anything.

I generally use throw away emails/domains for development

I’ve received these kinds of email since 2005. Blaming AI sounds kinda far-fetched…

Should Claude have access to user details? I’d say no, unless explicitly entered manually into a chat.

Instances of Claude should be heavily sandboxed and kept away from user data, far more so than they are now. The impression given by the desktop UI is that the LLM only has access to things explicitly added to a project.

This impression is not true, as evidenced by Claude pulling data from other sessions outside a project even when not instructed to (I’ve seen this a few times), and in this case pulling your email (from account details).

None of this information should be available to Claude, by design, not by instruction. Using text instructions it limit these machines is an incredibly flawed approach and should not be necessary. Anthropic should have the model access completely locked down by controls at the os level over file access, not open by default. That is how to fix this.

If a user wants to open access that should be an explicit choice from them, with a warning about possible consequences.

[0]: https://code.claude.com/docs/en/sandboxing

The sandbox covers shell commands only. Claude’s file tools, MCP servers, and hooks run outside it.

Also this is in my view the main job of a scaffold like claude code - to restrict what the agent can see and make sure it doesn't use info it should not. It's not something a user can easily or should have to attempt to control themselves.

Launch script checks that I can't accidentally run them with a working dir too far out (i.e. user folder).

This is hard to avoid. All it needs to do is make a git commit and look in the git log and it will find out who you are.

  - Option 1: Don't give Claude the `.git` directory
  - Option 2: Build a `.git` anonymizer that overwrite git history with bogus emails

LLMs are supposed to be a panacea for building digital systems. A sandbox inside which an LLM can operate freely surely should be one of the first systems we should all strive to engineer.

If we can't properly sandbox an LLM, I would say that's a pretty good sign that LLMs are not a panacea for building digital systems.

I would also like to add a list of allowed site, closing all the others, but it is quite complex from docker.

It is not safe like a isolated VM, but it is a good trade-off to avoid letting a model to wipe out all your home directory or looking into other files in your disk.

As always feedback is wellcomed

Maybe use two containers in the same docker network. One docker container has the agent and is not allowed to leave the network. The other container you'd run a proxy in with whitelisting and that container is allowed to leave the network.

since my employer is compelling me to throw out my expertise and rot my brain with Claude, I've been using clawk to sandbox instances in VMs: https://github.com/clawkwork/clawk

It's not perfect, but it works pretty well, and has done a nice job of forcing me to think through exactly what I'm allowing Claude access to and why, and what the risks are.

This is definitely a question that sounds straightforward but isn't. Like, when I ask antigravity to commit to git, it gets an error because ~/.gitconfig is outside the sandbox.

I'd feel a lot safer granting fine grained permissions like that, than knowing that the only thing stopping the LLM reading files is that it hasn't thought to do so.

I mean, I think Claude has some controls on file access, but I'm not exactly sure any more what is and what isn't allowed. The impression their desktop app gives is that you need to give permission for each and every file or folder access, but I'd feel a lot safer if that were imposed by an operating system level constraint, not claude trying to read the use of tools and ok/disallow them based on what an llm thinks.

That seems rather cumbersome.

How does everyone go about this?

What is an email provider that is trustworthy and does not want your phone number or credit card, so the email is not tied to you?

It's the same thing with web browsers. The browser adds my preferred language and operating system to the user-agent header, this way I can access the right content and download the right version of software quicker. I wouldn't want it to share my social security number but some sharing is alright to me. The problem here is people didn't know it was happening.

Maybe we need a new benchmark on how good models are at "keeping an eye" to if what they are about to do that doesn't come from a direct user instruction checks out with common sense plus user preferences. And we probably need a portable mechanism for users to manage such preferences (because we know instructions are not going to cut it, do we?).

I mean, the answer to “Is sending the user’s email address along with a web request to a third party requesting it, without the user’s explicit authorization, a good idea?” should easily be “no” …right?

How can they claim coding is solved when Claude Code is so terrible?

all joking aside, you need to have diversity of depth when it comes to skill sets in these tools and platforms. It does not pay to be a sole expert in Claude code or the anthropic ecosystem.

we have seen this movie before. The fakeness that Anthropic gives off publicly and through its leadership is a sign in and of itself.

I made a proxy that slows and caches my requests and deliberately sends my mail address to certain sites; to be polite. (eg to wikipedia)

https://github.com/franciscocarloserra/claude-code-context-d...

    Claude Code v2.1.319
  Opus 5.5 with medium effort · Claude Pro
       ~/projects


 what's my email                                                                                

    Claude Code v2.1.319
  Opus 5.5 with medium effort · Claude Pro
       ~/projects

 /clear                                                                                         

 /custom 
  ⎿  blank: mode: off

 do you have my email in context?                                                              

Cooked for 1s · done 11:01 AM Opus 5.5 14k ctx ~0.088%/call 5h 2.0%

blank: custom Opus 5.5 4k ctx ~0.085%/call 5h 2.0%

blank: blank Opus 5.5 1k ctx ~0.084%/call 5h 2.0%

[0] https://www.ayush.digital/blog/the-memory-heist

Two possible ways to address this are: keep it out of context, but there are many ways it could end up in context; or block it at the tool call.

Claude 2.1.317 supposedly has built-in privacy mod that might prevent this.

What I ended up doing, was a hook that checks if the command contains one of my email addresses and blocks it if it does. Claude says this should work. I have no idea if that's true.

The question at heart is: how else can the operator of a misbehaving bot/crawler be contacted?