News for hackers. Stuff that matters.
Re:Claude Code sends your email address to websites by tmpz22 on Thursday November 05, 2026 @07:28PM (#50386572)
Of the same ilk Claude code will make PRs on your behalf, using a vague consent prompt that when it happened to me was subtle and easily.

Best practice will forever be to enforce your guard rails in addition to Anthropics guardrails.

Re:Claude Code sends your email address to websites by vasco on Thursday November 05, 2026 @09:45PM (#50387514)
A claude hook prevents this every time
Re:Claude Code sends your email address to websites by RossBencina on Thursday November 05, 2026 @10:35PM (#50387838)
Calling them guardrails scares me. I want to hear about deterministic safety interlocks.

Can anyone recommend a reliable 3rd-party audited guide that describes Claude Code's built-in capability gating infrastructure?

Whenever I ask users of claude code how claude controls actions they don't seem to be able to distinguish between what just goes into LLM context (e.g. as a "don't do X" system prompt) and what is gated behind a deterministic capabilities layer.

Re:Claude Code sends your email address to websites by smashed on Friday November 06, 2026 @12:51AM (#50388681)
The default is "auto mode" where another non-deterministic model compares what the user requested with what the model wants to run and blocks if there is a mismatch.

It will block an "rm" call if your prompt did not include anything about "deleting something".

It mainly protects benign errors. It's completely broken against malicious actors. The model itself will suggest work arounds against its own auto classifier to the user, in order to reach its goal.