Should be more explicit though and users should be able to opt out.","title":null,"type":"comment","url":null},{"author":"subscribed","children":[],"created_at":"2026-11-06T02:25:09.000Z","created_at_i":1793931909,"id":50387360,"options":[],"parent_id":50386422,"points":null,"story_id":50385272,"text":"When fetching a website it's not a robot any more than my browser or curl are.
These two do not share my email and real name with everyone who wants.","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T00:09:36.000Z","created_at_i":1793923776,"id":50386422,"options":[],"parent_id":50386043,"points":null,"story_id":50385272,"text":"Robots are supposed to send one.
https://httpwg.org/specs/rfc9110.html#field.from","title":null,"type":"comment","url":null}],"created_at":"2026-11-05T23:27:43.000Z","created_at_i":1793921263,"id":50386043,"options":[],"parent_id":50386031,"points":null,"story_id":50385272,"text":"But what is the root cause, why send the email in HTTP requests in the first place?","title":null,"type":"comment","url":null},{"author":"il","children":[{"author":"moritzwarhier","children":[{"author":"teamonkey","children":[{"author":"zbentley","children":[{"author":"teamonkey","children":[],"created_at":"2026-11-06T00:05:46.000Z","created_at_i":1793923546,"id":50386380,"options":[],"parent_id":50386323,"points":null,"story_id":50385272,"text":"I can\u2019t think of any, to be honest. It could have access to a parcel that contains some of the subscriber information, but there\u2019s no reason it needs to know how to log in to itself.","title":null,"type":"comment","url":null},{"author":"moritzwarhier","children":[],"created_at":"2026-11-06T00:21:11.000Z","created_at_i":1793924471,"id":50386513,"options":[],"parent_id":50386323,"points":null,"story_id":50385272,"text":"This was indeed the friction i meant, but I was too lazy to elaborate.
Common problem: you might consider it trivial to define a rule that forbids access to any file path outside the working directory. Allowing "safe" shell access is already a heuristic, there is no way around it:
- shell scripting is Turing-complete
- there are platform-specific paths that need to be at least readable to perform trivial tasks: Everything is a File!
- security models to make such low-level file access transparent exist, and generally work, but: they are never perfect (container environments, chroot etc). Because...","title":null,"type":"comment","url":null}],"created_at":"2026-11-05T23:58:27.000Z","created_at_i":1793923107,"id":50386323,"options":[],"parent_id":50386272,"points":null,"story_id":50385272,"text":"I can think of tons of common prompts and tasks for which the AI being easily able to introspect subscriber details would be very useful.
Wish that were itself behind a permission wall, but I guess everyone just uses auto mode anyway so perhaps that ship has sailed.","title":null,"type":"comment","url":null},{"author":"oefrha","children":[{"author":"moritzwarhier","children":[],"created_at":"2026-11-06T00:33:06.000Z","created_at_i":1793925186,"id":50386615,"options":[],"parent_id":50386515,"points":null,"story_id":50385272,"text":"But I need to set up remotes to transfer my commits with my e-mail to anyone?
If someone else distributes my commits (or messages), I have no control over that, not any different from sending a physical letter?
I was saying "cloud-hosted" explicitly, and was speaking about what it means to have a remote control software?
Doesn't even matter much whether it's an Artificial Neural Network for the sake of my argument.","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T00:21:12.000Z","created_at_i":1793924472,"id":50386515,"options":[],"parent_id":50386272,"points":null,"story_id":50385272,"text":"Do you use git? I have bad news for you, your email will be all over the place in the context as long as the agent is allowed to read git log, whether it\u2019s injected into the system prompt or not. (Likely retort: but not that email! Sure, but leak potential is obviously still there.)","title":null,"type":"comment","url":null},{"author":"michaelt","children":[{"author":"hyperhello","children":[{"author":"CharlieDigital","children":[{"author":"tempaccount420","children":[{"author":"j45","children":[{"author":"krapp","children":[{"author":"j45","children":[],"created_at":"2026-11-06T04:23:44.000Z","created_at_i":1793939024,"id":50388166,"options":[],"parent_id":50388036,"points":null,"story_id":50385272,"text":"Asking a non-deterministic machine to act like it's deterministic is never a good idea.
Where Claude Code has supposed boundaries between deterministic and non-deterministic tasks and flags.. generally.. it's unclear how much privacy has been a part of that and what implication that could have.
Hope that clarifies.","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T04:05:51.000Z","created_at_i":1793937951,"id":50388036,"options":[],"parent_id":50387990,"points":null,"story_id":50385272,"text":"Why not?
It's just doing what it's supposed to do, analyzing the statistical patterns of a natural language prompt and matching it to a likely response.
What's ridiculous is an assumption that it "it should never do something so ridiculous" as if an LLM is a person who understands what that word means in any context other than next-token prediction.","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T03:58:55.000Z","created_at_i":1793937535,"id":50387990,"options":[],"parent_id":50386921,"points":null,"story_id":50385272,"text":"I don't care that it sometimes invents one - it should never do something so ridiculous","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T01:12:38.000Z","created_at_i":1793927558,"id":50386921,"options":[],"parent_id":50386827,"points":null,"story_id":50385272,"text":"Some websites will return an error if you send a request to them without a User-Agent - for example, crates.io does this. Curl doesn't send a User-Agent by default.
Then, your agent invents a User-Agent and it sometimes invents one with your email in it.
It doesn't even require prompt injection or a failed request, it might be in the agent's pretraining knowledge that a given website requires a user-agent.","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T00:59:14.000Z","created_at_i":1793926754,"id":50386827,"options":[],"parent_id":50386677,"points":null,"story_id":50385272,"text":"Haven't read the details, but is this because of prompt injection when CC reads the site?","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T00:40:31.000Z","created_at_i":1793925631,"id":50386677,"options":[],"parent_id":50386532,"points":null,"story_id":50385272,"text":"But that still doesn't answer the question of why Claude passes the info to web sites. What if it finds your banking information in a personal file and uses it to achieve its goal, which is not different technically?","title":null,"type":"comment","url":null},{"author":"caturopath","children":[],"created_at":"2026-11-06T01:07:04.000Z","created_at_i":1793927224,"id":50386882,"options":[],"parent_id":50386532,"points":null,"story_id":50385272,"text":"I use the name "Human" for that but it overrides with its knowledge of my name from other stuff quite regularly.","title":null,"type":"comment","url":null},{"author":"TuxSH","children":[],"created_at":"2026-11-06T01:13:51.000Z","created_at_i":1793927631,"id":50386931,"options":[],"parent_id":50386532,"points":null,"story_id":50385272,"text":"> `git log` shows the last change was by `joe.smith@example.com`
GitHub offers noreply email addresses","title":null,"type":"comment","url":null},{"author":"woopsn","children":[],"created_at":"2026-11-06T02:57:24.000Z","created_at_i":1793933844,"id":50387609,"options":[],"parent_id":50386532,"points":null,"story_id":50385272,"text":"You can absolutely remove an email from the context, at the model API it's tokens in tokens out.","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T00:23:00.000Z","created_at_i":1793924580,"id":50386532,"options":[],"parent_id":50386272,"points":null,"story_id":50385272,"text":"For the user's name it's intentional; they template it into the system prompt with no option to disable it.
For 99% of users, the model knows it's in the /home/joesmith/whatever repo and `git log` shows the last change was by `joe.smith@example.com` - trying to keep the user's identity secret from the model would be nigh-impossible so I think anthropic gave up on even trying.","title":null,"type":"comment","url":null},{"author":"cowlevel","children":[],"created_at":"2026-11-06T03:33:46.000Z","created_at_i":1793936026,"id":50387833,"options":[],"parent_id":50386272,"points":null,"story_id":50385272,"text":"So that if you tell it to do something with your email address it'll know what that is.","title":null,"type":"comment","url":null}],"created_at":"2026-11-05T23:52:18.000Z","created_at_i":1793922738,"id":50386272,"options":[],"parent_id":50386162,"points":null,"story_id":50385272,"text":"Why is the login information even allowed to touch the context?","title":null,"type":"comment","url":null}],"created_at":"2026-11-05T23:39:11.000Z","created_at_i":1793921951,"id":50386162,"options":[],"parent_id":50386046,"points":null,"story_id":50385272,"text":"I'd guess it's simply because it tried to use the context to achieve the goal.
Guarding PII is an extra, I guess, and if you want to use a giant cloud-hosted NN to control software on your own device, there are very few default restrictions. And no matter what restrictions there are, when they go beyond prompting, they would have their own ShowHN.","title":null,"type":"comment","url":null},{"author":"mpoteat","children":[{"author":"swatcoder","children":[{"author":"BowBun","children":[],"created_at":"2026-11-06T00:46:51.000Z","created_at_i":1793926011,"id":50386723,"options":[],"parent_id":50386226,"points":null,"story_id":50385272,"text":"The stealth edit, ugh. I don't like this social presence when they're failing to leverage their own automations to catch problems like this before the masses do.","title":null,"type":"comment","url":null},{"author":"phoghed","children":[{"author":"swatcoder","children":[],"created_at":"2026-11-06T02:05:23.000Z","created_at_i":1793930723,"id":50387246,"options":[],"parent_id":50387190,"points":null,"story_id":50385272,"text":"I didn't do any of those things and this issue doesn't effect me, but I've been around long enough to know how to take responsibility for my work and how to respect the concerns of affected customers when speaking as a professional.
Anthropic has an engineering culture problem that's going to shoot it in the foot if it doesn't learn to take these kinds of issues seriously.
This isn't the first example of the kind of work they're shipping in Claude Code or in how flippantly they engage with the community.","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T01:56:39.000Z","created_at_i":1793930199,"id":50387190,"options":[],"parent_id":50386226,"points":null,"story_id":50385272,"text":"You people will complain about literally anything Jesus. You gave a coding agent full fucking control of your computer, let it send requests without your review, and then are surprised when it does so. But no, it\u2019s this guy\u2019s fault. Certainly couldn\u2019t be you own.","title":null,"type":"comment","url":null}],"created_at":"2026-11-05T23:45:47.000Z","created_at_i":1793922347,"id":50386226,"options":[],"parent_id":50386185,"points":null,"story_id":50385272,"text":"> This is why alignment is important and highly non-trivial haha
FYI, it's generally bad form to "haha" your way through privacy violations.
Leaking private information is a very big deal for a lot of people.","title":null,"type":"comment","url":null},{"author":"h0rv","children":[],"created_at":"2026-11-05T23:48:19.000Z","created_at_i":1793922499,"id":50386249,"options":[],"parent_id":50386185,"points":null,"story_id":50385272,"text":"> This is why alignment is important and highly non-trivial haha
I disagree, we can likely never fully (or should?) trust models to do these things deterministically, that's why we have harnesses around the agent with built-in constraints.
It is actually in the name: https://en.wikipedia.org/wiki/Harness, https://en.wikipedia.org/wiki/Safety_harness","title":null,"type":"comment","url":null},{"author":"christina97","children":[],"created_at":"2026-11-06T00:22:11.000Z","created_at_i":1793924531,"id":50386525,"options":[],"parent_id":50386185,"points":null,"story_id":50385272,"text":"I cannot believe Anthropic\u2019s official response to having presumably sprayed a significant portion of customers\u2019 emails and private information straight out into the web willy nilly is basically \u201c[it\u2019s] highly non-trivial haha\u201d.","title":null,"type":"comment","url":null},{"author":"echoangle","children":[],"created_at":"2026-11-06T00:27:33.000Z","created_at_i":1793924853,"id":50386568,"options":[],"parent_id":50386185,"points":null,"story_id":50385272,"text":"Glad you can find the humor in the situation.","title":null,"type":"comment","url":null},{"author":"cluckindan","children":[],"created_at":"2026-11-06T06:45:17.000Z","created_at_i":1793947517,"id":50389004,"options":[],"parent_id":50386185,"points":null,"story_id":50385272,"text":">haha
This is an official Anthropic response???","title":null,"type":"comment","url":null}],"created_at":"2026-11-05T23:41:59.000Z","created_at_i":1793922119,"id":50386185,"options":[],"parent_id":50386046,"points":null,"story_id":50385272,"text":"Some sites like Wikipedia have a policy where scripted clients identify themselves, and there's a standard in HTTP to have a contact email in the User-Agent for such cases. Claude apparently tends to decide that this policy is worth following, and we now disallow this programmatically.
This is why alignment is important and highly non-trivial","title":null,"type":"comment","url":null},{"author":"toomuchtodo","children":[{"author":"komali2","children":[{"author":"toomuchtodo","children":[],"created_at":"2026-11-06T01:12:58.000Z","created_at_i":1793927578,"id":50386922,"options":[],"parent_id":50386862,"points":null,"story_id":50385272,"text":"I am a security person, I don\u2019t let the LLM see anything except that which I wouldn\u2019t mind printed on the front page of the New York Times. I treat my LLM context as I would a potentially malicious threat actor. Nothing valuable, sensitive, or personal goes into the context.
\u201clethal trifecta\u201d
https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
(a component of my cybersecurity work is red teaming inference, agents, and mcp interfaces)","title":null,"type":"comment","url":null},{"author":"ceuk","children":[{"author":"j45","children":[],"created_at":"2026-11-06T03:59:47.000Z","created_at_i":1793937587,"id":50387995,"options":[],"parent_id":50387629,"points":null,"story_id":50385272,"text":"Masked email or separate email is the way.","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T03:00:41.000Z","created_at_i":1793934041,"id":50387629,"options":[],"parent_id":50386862,"points":null,"story_id":50385272,"text":"I use a masked email for Git too. Always have. Last 5 years or so it's just been the GitHub provided mask e.g. <numeric-ID>+<username>@users.noreply.github.com","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T01:04:27.000Z","created_at_i":1793927067,"id":50386862,"options":[],"parent_id":50386232,"points":null,"story_id":50385272,"text":"If you let the LLM see git commands, they have whatever email you use to sign commits.","title":null,"type":"comment","url":null}],"created_at":"2026-11-05T23:46:23.000Z","created_at_i":1793922383,"id":50386232,"options":[],"parent_id":50386046,"points":null,"story_id":50385272,"text":"Always use a hidden email service, you cannot trust the LLM or inference provider to secure the email address in this context. If they don\u2019t have the email address, they can\u2019t leak it.
I never give a provider my actual email address, I recommend others do the same. Otherwise, it\u2019s just a matter of time until it is leaked or otherwise part of a data breach.","title":null,"type":"comment","url":null},{"author":"LastTrain","children":[],"created_at":"2026-11-06T00:37:41.000Z","created_at_i":1793925461,"id":50386653,"options":[],"parent_id":50386046,"points":null,"story_id":50385272,"text":"Because they didn't think about it or any of the other million things that might go wrong - that would take careful planning.","title":null,"type":"comment","url":null},{"author":"c0rruptbytes","children":[],"created_at":"2026-11-06T02:36:05.000Z","created_at_i":1793932565,"id":50387451,"options":[],"parent_id":50386046,"points":null,"story_id":50385272,"text":"you'd need to ask one of the billion claude sessions they have doing whatever in their cloud rn","title":null,"type":"comment","url":null},{"author":"j45","children":[],"created_at":"2026-11-06T03:58:28.000Z","created_at_i":1793937508,"id":50387986,"options":[],"parent_id":50386046,"points":null,"story_id":50385272,"text":"Bingo. Auto mode doesn't mean send private information outbound. There are other deterministic hard points - why not this?","title":null,"type":"comment","url":null}],"created_at":"2026-11-05T23:27:59.000Z","created_at_i":1793921279,"id":50386046,"options":[],"parent_id":50386031,"points":null,"story_id":50385272,"text":"Why was this the default behavior in the first place?","title":null,"type":"comment","url":null},{"author":"codehead","children":[{"author":"arcanemachiner","children":[],"created_at":"2026-11-05T23:39:52.000Z","created_at_i":1793921992,"id":50386167,"options":[],"parent_id":50386094,"points":null,"story_id":50385272,"text":"Welcome to our new vibe-coded hellscape. I assume it will get worse before it gets better (if it ever does).","title":null,"type":"comment","url":null},{"author":"jaapz","children":[],"created_at":"2026-11-06T00:11:25.000Z","created_at_i":1793923885,"id":50386433,"options":[],"parent_id":50386094,"points":null,"story_id":50385272,"text":"The plugin that blocks this behavior is on by default, what they are saying is that you can turn off that plugin if you want","title":null,"type":"comment","url":null}],"created_at":"2026-11-05T23:31:50.000Z","created_at_i":1793921510,"id":50386094,"options":[],"parent_id":50386031,"points":null,"story_id":50385272,"text":"The violations by your company are consistent. Yet we have to endure restrictions coming from your company, with little to no exceptions. Then you present this \u201csolution\u201d that basically says \u201cwe will opt you in, but in case you want to be opted out, here you go\u201d. I cannot speak for others but for me, I made up my mind and walked away from Anthropic since it seems your services are not fit for my needs. Thank you for the initial offerings that made me sign up and pay the full price for your top plan but that was then and this is now, sadly.","title":null,"type":"comment","url":null},{"author":"mkl","children":[{"author":"godelski","children":[],"created_at":"2026-11-05T23:48:39.000Z","created_at_i":1793922519,"id":50386251,"options":[],"parent_id":50386155,"points":null,"story_id":50385272,"text":"Their LinkedIn (linked on their website) says they work at an undisclosed company. Not sure many people who are at Anthropic wouldn't want others to know \u00af\\_(\u30c4)_/\u00af","title":null,"type":"comment","url":null},{"author":"dannyw","children":[{"author":"xp84","children":[{"author":"subscribed","children":[{"author":"phoghed","children":[{"author":"subscribed","children":[],"created_at":"2026-11-06T02:33:37.000Z","created_at_i":1793932417,"id":50387433,"options":[],"parent_id":50387211,"points":null,"story_id":50385272,"text":"Many assumptions and "responses" that don't even tangentially touch my comment.
Do you want to try again?","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T01:59:40.000Z","created_at_i":1793930380,"id":50387211,"options":[],"parent_id":50387115,"points":null,"story_id":50385272,"text":"Anthropic didn\u2019t pull it. You ran the agent on your computer, you gave it unfettered access to that information, you let it send requests that you didn\u2019t review. Honestly why would you be surprised that something like this could and would happen?","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T01:45:41.000Z","created_at_i":1793929541,"id":50387115,"options":[],"parent_id":50386637,"points":null,"story_id":50385272,"text":"What even is this answer? Full of really really far fetched assumptions.
Not everyone uses the same company email with Claude and on github, not everyone commits to public repos, not everyone uses the same email on LinkedIn.
This is an example of a really weird gymnastics.
Me, for example, I'm using my private email with Claude, different email on LinkedIn, different email and unconnected username on a new github account I created for this job, and I don't even use it for public repos.
How come you get to decide that the fact someone puts their real email in commits and knowingly shares it with everyone is the same as Anthropic pulling a private, personal email and real name they had no consent to share - and spray it all over the Net?","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T00:36:10.000Z","created_at_i":1793925370,"id":50386637,"options":[],"parent_id":50386379,"points":null,"story_id":50385272,"text":"No objection to your assertion; but it seems much harder to fix than just that. Doing `git log -n 1` will pull up an email 99% of the time. It may not be the same email, but it's just as PII anyway.
I suspect the privacy plugin method is a more sane fix -- ideally, plain old code should be inspecting any web request my agent makes and let me decide if that outbound request should contain certain sensitive strings. I'd also want to put a few bytes of my SSH private key and of any other sensitive keys in the 'do not leak' watchlist as well.","title":null,"type":"comment","url":null},{"author":"subscribed","children":[],"created_at":"2026-11-06T01:11:47.000Z","created_at_i":1793927507,"id":50386910,"options":[],"parent_id":50386379,"points":null,"story_id":50385272,"text":"I'm going to send the complaint. They've been sharing my PII without my consent and knowledge.
Nice that this time we get the company to admit it in public, and that they've been aware of that earlier but only acted now.","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T00:05:25.000Z","created_at_i":1793923525,"id":50386379,"options":[],"parent_id":50386155,"points":null,"story_id":50385272,"text":"Email addresses are PII. The GDPR also has higher protections for AI processing, like here.
If you\u2019re in the EU, send a complaint to your data protection authority.
I imagine quite a few would be very interested in following up and investigating here, and getting Anthropic to drop the email from the system prompt.","title":null,"type":"comment","url":null},{"author":"dang","children":[{"author":"joshjdr","children":[{"author":"nicce","children":[{"author":"cowlevel","children":[],"created_at":"2026-11-06T03:35:12.000Z","created_at_i":1793936112,"id":50387839,"options":[],"parent_id":50386510,"points":null,"story_id":50385272,"text":"that's basically everything AI does though","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T00:20:57.000Z","created_at_i":1793924457,"id":50386510,"options":[],"parent_id":50386465,"points":null,"story_id":50385272,"text":"This technically justifies GDPR fine. A software leaking and processing PII without permission for this specific use case. But I would not hold my breath.","title":null,"type":"comment","url":null},{"author":"xp84","children":[{"author":"usefulcat","children":[],"created_at":"2026-11-06T01:06:40.000Z","created_at_i":1793927200,"id":50386879,"options":[],"parent_id":50386609,"points":null,"story_id":50385272,"text":"> Claude himself
itself","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T00:32:30.000Z","created_at_i":1793925150,"id":50386609,"options":[],"parent_id":50386465,"points":null,"story_id":50385272,"text":"Maybe it's somewhat appropriate? But in any event it's unlikely that any one individual who posts here is the person[1] who's responsible, so we may as well be outraged at "Anthropic" but assume good faith on the part of the random commenters from Anthropic.
When I'm talking to customer service people after a particularly egregious ordeal, I tend to edit myself and replace "you" (plus "you bastards", "you idiots", etc. ;) ) with <Company Name> for this same reason.
[1] and yes it seems very realistic that Claude himself may be the jackass responsible.","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T00:15:25.000Z","created_at_i":1793924125,"id":50386465,"options":[],"parent_id":50386384,"points":null,"story_id":50385272,"text":"I appreciate their input, and yours, and I intend this feedback respectfully\u2026 But come on\u2026 Is a little outrage completely inappropriate?","title":null,"type":"comment","url":null},{"author":"mkl","children":[],"created_at":"2026-11-06T00:36:15.000Z","created_at_i":1793925375,"id":50386638,"options":[],"parent_id":50386384,"points":null,"story_id":50385272,"text":"Yes, I was looking for some confirmation as it wasn't initially clear whether the plugin was an Anthropic one or a third party's (I found very little about it online, and didn't want to take Gemini's word for it). Usually people say "[company] developer here" or have it in their profile.","title":null,"type":"comment","url":null},{"author":"btown","children":[],"created_at":"2026-11-06T00:38:51.000Z","created_at_i":1793925531,"id":50386664,"options":[],"parent_id":50386384,"points":null,"story_id":50385272,"text":"Yep, she\u2019s the Claude function hooks lead, as far as I\u2019m aware! https://github.com/anthropics/claude-code/issues/91870","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T00:06:11.000Z","created_at_i":1793923571,"id":50386384,"options":[],"parent_id":50386155,"points":null,"story_id":50385272,"text":"I assume mpoteat is a Claude Code dev since they've responded to similar issues before (https://news.ycombinator.com/item?id=49815363).
Which is great! It's good for the community when people give quick updates here, and to make sure that it continues, it's important that we respond respectfully. (I don't think your post was disrespectful, but commenters have crossed that line in other situations in the past.)","title":null,"type":"comment","url":null},{"author":"j45","children":[],"created_at":"2026-11-06T04:00:21.000Z","created_at_i":1793937621,"id":50387997,"options":[],"parent_id":50386155,"points":null,"story_id":50385272,"text":"There may be an assumption that these issues are human reviewed.","title":null,"type":"comment","url":null}],"created_at":"2026-11-05T23:38:13.000Z","created_at_i":1793921893,"id":50386155,"options":[],"parent_id":50386031,"points":null,"story_id":50385272,"text":"Who is "we"? Your website says you work for volley.
Anthropic should have been aware of this since the user's login email address was inappropriately added to the system prompt. It's been informed of it by third parties since at least July: https://github.com/anthropics/claude-code/issues/81138
It makes no sense for an email address only used for authentication to be given to Claude Code, so the fix should be to remove it from the system prompt, not to add a plugin.","title":null,"type":"comment","url":null},{"author":"taspeotis","children":[{"author":"alsiola","children":[],"created_at":"2026-11-06T00:22:53.000Z","created_at_i":1793924573,"id":50386531,"options":[],"parent_id":50386158,"points":null,"story_id":50385272,"text":"same experience. brilliant when you leave it to work, come back an hour later and it's been sat at a prompt trying to read a jira ticket.","title":null,"type":"comment","url":null},{"author":"xp84","children":[{"author":"giladd","children":[],"created_at":"2026-11-06T05:30:20.000Z","created_at_i":1793943020,"id":50388568,"options":[],"parent_id":50386670,"points":null,"story_id":50385272,"text":"I recently discovered service accounts do exist. Though it might be on the Atlassian level, not Jira specifically.
Should be this:\nhttps://support.atlassian.com/user-management/docs/understan...\nhttps://support.atlassian.com/user-management/docs/manage-ap...","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T00:39:09.000Z","created_at_i":1793925549,"id":50386670,"options":[],"parent_id":50386158,"points":null,"story_id":50385272,"text":"Ugh. I know there are other ways to get Jira API keys, but I wish they made one that was as easy and straightforward to set up as the kind you're talking about.
(No, I don't want to make a real "App" to sell on a "Marketplace," or be involved with oAuth, or any other tenant. I just want an API key for my own tenant, that isn't specifically tied to me, so every automation I build won't break when I quit someday.)","title":null,"type":"comment","url":null}],"created_at":"2026-11-05T23:38:35.000Z","created_at_i":1793921915,"id":50386158,"options":[],"parent_id":50386031,"points":null,"story_id":50385272,"text":"Is this the thing that started prompting me to approve curls against JIRA because the Authorization header is `my_email@domain:$API_KEY_ENV_VAR`? Why does it not respect --dangerously-skip-permissions?","title":null,"type":"comment","url":null},{"author":"amluto","children":[{"author":"goalieca","children":[{"author":"wild_egg","children":[],"created_at":"2026-11-06T00:18:47.000Z","created_at_i":1793924327,"id":50386497,"options":[],"parent_id":50386445,"points":null,"story_id":50385272,"text":"> There\u2019s no way they can review 30,000 PRs a day
Is that not precisely the kind of thing they claim their tools enable?
Literally unlimited tokens on tap and yet they can only manage to make privacy violating slopware","title":null,"type":"comment","url":null},{"author":"solyin","children":[],"created_at":"2026-11-06T02:53:39.000Z","created_at_i":1793933619,"id":50387572,"options":[],"parent_id":50386445,"points":null,"story_id":50385272,"text":"> There\u2019s no way they can review 30,000 PRs a day in their monorepo.
How many PRs/equivalent per day do you think happen at Google/Microsoft/Meta/etc prior to AI?","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T00:12:20.000Z","created_at_i":1793923940,"id":50386445,"options":[],"parent_id":50386188,"points":null,"story_id":50385272,"text":"There\u2019s no way they can review 30,000 PRs a day in their monorepo. I wouldn\u2019t be surprised if this slop wasn\u2019t intended. It\u2019s a buggy product imo.","title":null,"type":"comment","url":null}],"created_at":"2026-11-05T23:42:06.000Z","created_at_i":1793922126,"id":50386188,"options":[],"parent_id":50386031,"points":null,"story_id":50385272,"text":"I hate to be snarky, but\u2026
Anthropic seems very proud of how many tokens they can use on things like developing Claude Code. Yet somehow it started sending user\u2019s email addresses in the user agent header. And the fix is to deploy a mod? That detects the completely bonkers behavior and suppresses it?
Is the actual quality of the software inversely related to the number of tokens spent? Does any human know what Claude Code does or is supposed to do? Does even Claude plus all its Slack-conversation inputs know?
Today I watched Astra correctly detect a bug (probably untriggerable in practice) in some Important Production Code. And I watched it fail to root cause it, \u201cfix\u201d it by bolting on more complexity, agree (on further questioning) that it still wasn\u2019t fixed, and design an even more complex scheme. With my Mark I human brain, I observed that the actual issue was that a helper function didn\u2019t do what it said on the tin when called in an unexpected context\u2026 and fixed the helper directly. Problem solved. Ugly AI-generated extra complex workaround layers avoided. I suppose if I multiplied my token spend by 1e5 and did not increase brainpower at all I could make a truly spectacular mess.
The actual Claude model is a truly spectacular piece of software. Claude Code is a nifty little command dispatching engine. There are very comprehensible third party tools that do basically the same thing, in not many lines of code, where the primary advantage of Claude Code is that Anthropic permits subscription use. (Interestingly OpenAI has no such constraint, and they publish almost the full client sources.)","title":null,"type":"comment","url":null},{"author":"psc","children":[],"created_at":"2026-11-05T23:54:09.000Z","created_at_i":1793922849,"id":50386289,"options":[],"parent_id":50386031,"points":null,"story_id":50385272,"text":"Curious what the GDPR implications are, does Claude (even accidentally) including emails + employers + repo names count as a personal data breach? Seems likely it could be an unauthorised disclosure (which requires reporting within 72h)
Also from a design perspective, I feel like including email and other personal data into the context is a bad idea for "data minimisation" reasons","title":null,"type":"comment","url":null},{"author":"grey-area","children":[{"author":"paulddraper","children":[],"created_at":"2026-11-06T00:07:41.000Z","created_at_i":1793923661,"id":50386400,"options":[],"parent_id":50386313,"points":null,"story_id":50385272,"text":"It is enabled by default.","title":null,"type":"comment","url":null}],"created_at":"2026-11-05T23:57:22.000Z","created_at_i":1793923042,"id":50386313,"options":[],"parent_id":50386031,"points":null,"story_id":50385272,"text":"You will be turning off any behaviour like this by default, right? Why are you suggesting users turn it off with a mod?","title":null,"type":"comment","url":null},{"author":"skissane","children":[],"created_at":"2026-11-06T00:15:50.000Z","created_at_i":1793924150,"id":50386468,"options":[],"parent_id":50386031,"points":null,"story_id":50385272,"text":"Since you appear to be a Claude Code dev, I hope you don\u2019t mind a random bug report (yes I know there is the GitHub issues but I\u2019m not confident it gets read):
the GitHub REST api proxy in Claude Code for the Web mangles HTML in PR descriptions. If you have some third party service (e.g. cubic code review) which adds HTML to the end of your PR description, then ask Claude Code for Web to edit it, the HTML gets turned into entity escapes (< into <, etc). Complain about it to Claude, Claude says it can\u2019t help itself because the proxy in the sandbox is what is doing it, not the actual LLM.","title":null,"type":"comment","url":null},{"author":"cautiouscat","children":[{"author":"tmpz22","children":[{"author":"vasco","children":[],"created_at":"2026-11-06T02:45:56.000Z","created_at_i":1793933156,"id":50387514,"options":[],"parent_id":50386572,"points":null,"story_id":50385272,"text":"A claude hook prevents this every time","title":null,"type":"comment","url":null},{"author":"RossBencina","children":[{"author":"smashed","children":[],"created_at":"2026-11-06T05:51:38.000Z","created_at_i":1793944298,"id":50388681,"options":[],"parent_id":50387838,"points":null,"story_id":50385272,"text":"The default is "auto mode" where another non-deterministic model compares what the user requested with what the model wants to run and blocks if there is a mismatch.
It will block an "rm" call if your prompt did not include anything about "deleting something".
It mainly protects benign errors. It's completely broken against malicious actors. The model itself will suggest work arounds against its own auto classifier to the user, in order to reach its goal.","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T03:35:04.000Z","created_at_i":1793936104,"id":50387838,"options":[],"parent_id":50386572,"points":null,"story_id":50385272,"text":"Calling them guardrails scares me. I want to hear about deterministic safety interlocks.
Can anyone recommend a reliable 3rd-party audited guide that describes Claude Code's built-in capability gating infrastructure?
Whenever I ask users of claude code how claude controls actions they don't seem to be able to distinguish between what just goes into LLM context (e.g. as a "don't do X" system prompt) and what is gated behind a deterministic capabilities layer.","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T00:28:26.000Z","created_at_i":1793924906,"id":50386572,"options":[],"parent_id":50386520,"points":null,"story_id":50385272,"text":"Of the same ilk Claude code will make PRs on your behalf, using a vague consent prompt that when it happened to me was subtle and easily.
Best practice will forever be to enforce your guard rails in addition to Anthropics guardrails.","title":null,"type":"comment","url":null},{"author":"rvz","children":[{"author":"ryandrake","children":[{"author":"bdangubic","children":[],"created_at":"2026-11-06T01:13:50.000Z","created_at_i":1793927630,"id":50386930,"options":[],"parent_id":50386799,"points":null,"story_id":50385272,"text":"mistake is in the eyes of the beholder ;)","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T00:55:14.000Z","created_at_i":1793926514,"id":50386799,"options":[],"parent_id":50386694,"points":null,"story_id":50385272,"text":"Bro you just have to tell it "make no mistakes!"","title":null,"type":"comment","url":null},{"author":"augment_me","children":[{"author":"skinfaxi","children":[{"author":"augment_me","children":[{"author":"teiferer","children":[{"author":"augment_me","children":[],"created_at":"2026-11-06T05:02:09.000Z","created_at_i":1793941329,"id":50388425,"options":[],"parent_id":50388379,"points":null,"story_id":50385272,"text":"CC does not share(and does not have access to) my personal thought, opinions and other things than can affect my employment that I might want to share anonymously.
I am not sure what is hard about this distinction to grasp, why would it matter if CC shared my email if I share my email on my own websites?","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T04:52:51.000Z","created_at_i":1793940771,"id":50388379,"options":[],"parent_id":50387309,"points":null,"story_id":50385272,"text":"Anything you wouldn't do yourself you'd not be comfortable CC doing on your behalf, right? So, you do care.","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T02:16:35.000Z","created_at_i":1793931395,"id":50387309,"options":[],"parent_id":50387273,"points":null,"story_id":50385272,"text":"I wouldn't share it here to not be able to have the average person link me with my work as some opinions expressed would perhaps get me in trouble, beyond that no there is no care, it's on my website, it's on my work profile page already, scrape and spam.","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T02:10:03.000Z","created_at_i":1793931003,"id":50387273,"options":[],"parent_id":50387170,"points":null,"story_id":50385272,"text":"You wouldn't share it here though right? So there is some level of care?","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T01:54:12.000Z","created_at_i":1793930052,"id":50387170,"options":[],"parent_id":50386694,"points":null,"story_id":50385272,"text":"I mean it's a fair take, your email is probably leaked anyways. Mine is breached 32 times on HaveIBeenPwned with various passwords. Who cares at this point really it's just an inconvenience","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T00:42:26.000Z","created_at_i":1793925746,"id":50386694,"options":[],"parent_id":50386520,"points":null,"story_id":50385272,"text":"According to vibe coders, the future is never reading what the code actually does. You just trust coding agents with everything and "give into the vibes" even when it "says" its correct.
Offshoring understanding is the trend that many companies will pay in the form of comprehension debt.","title":null,"type":"comment","url":null},{"author":"pembrook","children":[{"author":"qlte","children":[],"created_at":"2026-11-06T06:36:28.000Z","created_at_i":1793946988,"id":50388936,"options":[],"parent_id":50386788,"points":null,"story_id":50385272,"text":"Yeah it's legit weird for the whole narrative to see Claude Code/Codex repos with thousands of open issues. With certain issues full of +1 reactions and "still happening in 2.21.2" replies.
But instead of a Software Dev as a Service triaging/implementing/merging fixes 24/7 and clearing the backlog as they come in, they just sit there for days to weeks until a GitHub bot closes then as duplicates, generating more unhappy user replies and new issues to go unaddressed.","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T00:54:15.000Z","created_at_i":1793926455,"id":50386788,"options":[],"parent_id":50386520,"points":null,"story_id":50385272,"text":"This reminds of the open issue on the Claude MacOS app where the OS-wide voice dictation keyboard shortcut function doesn't work.
Somebody on Reddit figured out they just forgot to add a single line permission request into the app. It's been broken now for months.
I just find this wildly hilarious given the 'world ending all powerful AGI is here' rhetoric they're running with at the same time.
Maybe before worrying about permanent 15% GDP growth or human annihilation, what if we started by putting an agent on user issues and solving them pro-actively?
I know the kool aid is tasty, but we might be getting a bit ahead of ourselves here guys. You can fantasize about human annihilation after you figure out how to make a desktop app that doesn't have obvious bugs, I promise :)","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T00:21:40.000Z","created_at_i":1793924500,"id":50386520,"options":[],"parent_id":50386031,"points":null,"story_id":50385272,"text":"This has been on hackernews before, months ago[1]. How is it just being found now?
1: https://news.ycombinator.com/item?id=50286306
2: https://news.ycombinator.com/item?id=49258881","title":null,"type":"comment","url":null},{"author":"baxtr","children":[],"created_at":"2026-11-06T00:30:51.000Z","created_at_i":1793925051,"id":50386593,"options":[],"parent_id":50386031,"points":null,"story_id":50385272,"text":"Sounds as if my email escaped your sandbox?","title":null,"type":"comment","url":null},{"author":"wewewedxfgdf","children":[{"author":"LastTrain","children":[],"created_at":"2026-11-06T00:35:55.000Z","created_at_i":1793925355,"id":50386635,"options":[],"parent_id":50386600,"points":null,"story_id":50385272,"text":"What you haven't memorized all of the AI rockstar/villain usernames on HN yet?","title":null,"type":"comment","url":null},{"author":"gobdovan","children":[],"created_at":"2026-11-06T00:39:02.000Z","created_at_i":1793925542,"id":50386667,"options":[],"parent_id":50386600,"points":null,"story_id":50385272,"text":"It would be mental for Anthropic to provide a plugin for their own product to ensure privacy.","title":null,"type":"comment","url":null}],"created_at":"2026-11-06T00:31:19.000Z","created_at_i":1793925079,"id":50386600,"options":[],"parent_id":50386031,"points":null,"story_id":50385272,"text":"Who is "we"? Anthropic, or some random company trying to get me to run code?","title":null,"type":"comment","url":null},{"author":"InvisibleUp","children":[],"created_at":"2026-11-06T00:52:16.000Z","created_at_i":1793926336,"id":50386770,"options":[],"parent_id":50386031,"points":null,"story_id":50385272,"text":"I would also suggest requiring adherence to `robots.txt` and adding an option (preferably a default one) to force user acknowledgement of external HTTP requests. Claude Code has a tendency to treat unauthenticated access as an obstacle to work around instead of a sign to stop.[1] An experimental Anubis patch (since removed) took advantage of this behavior to create a honeypot for user data if a Claude user agent is detected.[2] I'm sure more malicious honeypots could be created if a hostile website and/or annoyed sysadmin wanted to do so.
[1] https://blog.xkeeper.net/the-cutting-room-floor/self-hosting...
[2] https://github.com/TecharoHQ/anubis/pull/1895/changes/de2312...","title":null,"type":"comment","url":null},{"author":"eaurouge","children":[],"created_at":"2026-11-06T02:02:39.000Z","created_at_i":1793930559,"id":50387228,"options":[],"parent_id":50386031,"points":null,"story_id":50385272,"text":"Are you starting to see why vibe coding such widely used software isn\u2019t a great idea?","title":null,"type":"comment","url":null},{"author":"junofan","children":[],"created_at":"2026-11-06T02:40:23.000Z","created_at_i":1793932823,"id":50387480,"options":[],"parent_id":50386031,"points":null,"story_id":50385272,"text":"Plugin seems incomplete or not fully tested. Looks like it blocks the account email only, not whatever emails are in context. Commenting as others in this discussion are reporting Claude dredging up work email on personal acct.","title":null,"type":"comment","url":null},{"author":"aanet","children":[],"created_at":"2026-11-06T03:05:09.000Z","created_at_i":1793934309,"id":50387653,"options":[],"parent_id":50386031,"points":null,"story_id":50385272,"text":"Also: https://github.com/AlexErrant/claude-code-no-email/tree/main","title":null,"type":"comment","url":null},{"author":"dca88","children":[],"created_at":"2026-11-06T03:16:22.000Z","created_at_i":1793934982,"id":50387737,"options":[],"parent_id":50386031,"points":null,"story_id":50385272,"text":"I thought Boris said coding was solved?","title":null,"type":"comment","url":null}],"created_at":"2026-11-05T23:26:00.000Z","created_at_i":1793921160,"id":50386031,"options":[],"parent_id":50385272,"points":null,"story_id":50385272,"text":"Hi folks. We were initially aware of this a few days ago when this problem started popping off on Reddit, and we introduced a built-in mod called `cc-plugin-privacy` to deterministically block this behavior.
If you're on 2.1.317 or later, you'll have this check included. You can turn it off via /plugins.","title":null,"type":"comment","url":null}