But that still doesn't answer the question of why Claude passes the info to web sites. What if it finds your banking information in a personal file and uses it to achieve its goal, which is not different technically?

Haven't read the details, but is this because of prompt injection when CC reads the site?

Some websites will return an error if you send a request to them without a User-Agent - for example, crates.io does this. Curl doesn't send a User-Agent by default.

Then, your agent invents a User-Agent and it sometimes invents one with your email in it.

I don't care that it sometimes invents one - it should never do something so ridiculous

Why not?

It's just doing what it's supposed to do, analyzing the statistical patterns of a natural language prompt and matching it to a likely response.

What's ridiculous is an assumption that it "it should never do something so ridiculous" as if an LLM is a person who understands what that word means in any context other than next-token prediction.

Asking a non-deterministic machine to act like it's deterministic is never a good idea.

Where Claude Code has supposed boundaries between deterministic and non-deterministic tasks and flags.. generally.. it's unclear how much privacy has been a part of that and what implication that could have.

Hope that clarifies.

I use the name "Human" for that but it overrides with its knowledge of my name from other stuff quite regularly.

> `git log` shows the last change was by `[email protected]`

GitHub offers noreply email addresses

You can absolutely remove the user's email from the context.