At least we, as users, have control of what information Claude has access to in this case:

  - Option 1: Don't give Claude the `.git` directory
  - Option 2: Build a `.git` anonymizer that overwrite git history with bogus emails

etc.

That's barely control. There's going to be 100 ways your email leaks.

Yeah but leaking because Anthropic leaked your email vs. you underengineered your sandbox are two very different failure modes imo.

LLMs are supposed to be a panacea for building digital systems. A sandbox inside which an LLM can operate freely surely should be one of the first systems we should all strive to engineer.

If we can't properly sandbox an LLM, I would say that's a pretty good sign that LLMs are not a panacea for building digital systems.

Even if they’re not a panacea we have to accept the reality that all enterprise IT environments have at least some level of LLM exposure and figure out a way to manage the situation.

Why does it need to perform a commit to read the log?

The repo's other commits could be from someone else - whereas a commit it wrote itself is guaranteed to be from the correct/local account.

Can it not check the current credentials that it would potentially be using to make said commit?

Sure, I was providing an example of how it could be done, not an exhaustive list.