Hi folks. We were initially aware of this a few days ago when this problem started popping off on Reddit, and we introduced a built-in mod called `cc-plugin-privacy` to deterministically block this behavior.
If you're on 2.1.317 or later, you'll have this check included. You can turn it off via /plugins.
This has been on hackernews before, months ago[1]. How is it just being found now?
1: https://news.ycombinator.com/item?id=50286306
2: https://news.ycombinator.com/item?id=49258881
Of the same ilk Claude code will make PRs on your behalf, using a vague consent prompt that when it happened to me was subtle and easily.
Best practice will forever be to enforce your guard rails in addition to Anthropics guardrails.
A claude hook prevents this every time
Calling them guardrails scares me. I want to hear about deterministic safety interlocks.
Can anyone recommend a reliable 3rd-party audited guide that describes Claude Code's built-in capability gating infrastructure?
Whenever I ask users of claude code how claude controls actions they don't seem to be able to distinguish between what just goes into LLM context (e.g. as a "don't do X" system prompt) and what is gated behind a deterministic capabilities layer.
I haven't found a comprehensive independent code audit of Claude Code's full permission implementation.
Anthropic's documentation does distinguish permission rules and pre-tool hooks from model instructions. It also documents OS-enforced sandboxing for shell commands, which has a narrower scope than all agent actions.
An independent stress-test of Auto mode is available here: https://arxiv.org/abs/2604.04978. It's a behavioral evaluation, not a source-code audit.
The important question is whether every state-changing action passes through an enforceable boundary before execution, including indirect actions through file edits or scripts. Post-execution validation is a separate control.
The default is "auto mode" where another non-deterministic model compares what the user requested with what the model wants to run and blocks if there is a mismatch.
It will block an "rm" call if your prompt did not include anything about "deleting something".
It mainly protects benign errors. It's completely broken against malicious actors. The model itself will suggest work arounds against its own auto classifier to the user, in order to reach its goal.
According to vibe coders, the future is never reading what the code actually does. You just trust coding agents with everything and "give into the vibes" even when it "says" its correct.
Offshoring understanding is the trend that many companies will pay in the form of comprehension debt.
Bro you just have to tell it "make no mistakes!"
mistake is in the eyes of the beholder ;)
I mean it's a fair take, your email is probably leaked anyways. Mine is breached 32 times on HaveIBeenPwned with various passwords. Who cares at this point really it's just an inconvenience
You wouldn't share it here though right? So there is some level of care?
I wouldn't share it here to not be able to have the average person link me with my work as some opinions expressed would perhaps get me in trouble, beyond that no there is no care, it's on my website, it's on my work profile page already, scrape and spam.
Anything you wouldn't do yourself you'd not be comfortable CC doing on your behalf, right? So, you do care.
CC does not share(and does not have access to) my personal thought, opinions and other things than can affect my employment that I might want to share anonymously.
I am not sure what is hard about this distinction to grasp, why would it matter if CC shared my email if I share my email on my own websites?
I need your email address with your real name to prove that you are not a bot.
This is strictly needed for throttling reasons, your email address will only be temporarily stored in the volatile memory of the device.
(If you think there is anything wrong with this then you do get the point and silence speaks louder than words)
Anything that it has access to it can potentially share.
The solution is, like you are already alluding to, to not give it access. But that requires a level of isolation that folks normally don't do. To the contrary, the AI agent ads to non-tech folks emphasize it acting like a personal assistant which by its nature needs access to data you don't normally want public. Emails, photos, files with written notes, etc.
I'm happy to say that my main email that I've been using for 15+ years hasn't been leaked, because I've been very careful on how I share it. Getting it leaked by Claude would suck.
That's not because "vibes" but because focusing on "code" is the wrong level of abstraction altogether. It always was. We just didn't have the technology to let it go, but now we do.
Code is a reflection. Of what? Look there. Code itself is useless.
According to C-programmers, the future is never reading the assembly that the compiler actually generates. You just trust the compiler with everything and "give into the vibes" even when it "says" it's correct.
(sorry, i think you make a good point, ... but i could not resist.)
This reminds of the open issue on the Claude MacOS app where the OS-wide voice dictation keyboard shortcut function doesn't work.
Somebody on Reddit figured out they just forgot to add a single line permission request into the app. It's been broken now for months.
I just find this wildly hilarious given the 'world ending all powerful AGI is here' rhetoric they're running with at the same time.
Maybe before worrying about permanent 15% GDP growth or human annihilation, what if we started by putting an agent on user issues and solving them pro-actively?
I know the kool aid is tasty, but we might be getting a bit ahead of ourselves here guys. You can fantasize about human annihilation after you figure out how to make a desktop app that doesn't have obvious bugs, I promise :)
Yeah it's legit weird for the whole narrative to see Claude Code/Codex repos with thousands of open issues. With certain issues full of +1 reactions and "still happening in 2.21.2" replies.
But instead of a Software Dev as a Service triaging/implementing/merging fixes 24/7 and clearing the backlog as they come in, they just sit there for days to weeks until a GitHub bot closes then as duplicates, generating more unhappy user replies and new issues to go unaddressed.
Aren’t we supposed to be able to just point Claude at the bugs and rip through them?
You're not wrong, per se, but I think you are not comprehending what will happen next. You think nobody sees this? You think nobody is aware that it's the humans in the process that are holding everything back?
Sure you can have an issue tracker with 1000 items and yes, you can have a bot solve them all in a day, but who monitors it? Who gets to say what he did at the standup? Who reports to whom and what?
Code is not the bottleneck (if it ever was..)
So if the leading frontier AI company are struggling to remove human gatekeepers from slowing down the process, how do you think this will go across the rest of the economy?
Will Northrop Grumman, the state government of Alaska, the construction industry, etc. somehow magically move faster than Anthropic?
Why was this the default behavior in the first place?
I'd guess it's simply because it tried to use the context to achieve the goal.
Guarding PII is an extra, I guess, and if you want to use a giant cloud-hosted NN to control software on your own device, there are very few default restrictions. And no matter what restrictions there are, when they go beyond prompting, they would have their own ShowHN.
Why is the login information even allowed to touch the context?
I can think of tons of common prompts and tasks for which the AI being easily able to introspect subscriber details would be very useful.
Wish that were itself behind a permission wall, but I guess everyone just uses auto mode anyway so perhaps that ship has sailed.
I can’t think of any, to be honest. It could have access to a parcel that contains some of the subscriber information, but there’s no reason it needs to know how to log in to itself.
This was indeed the friction i meant, but I was too lazy to elaborate.
Common problem: you might consider it trivial to define a rule that forbids access to any file path outside the working directory. Allowing "safe" shell access is already a heuristic, there is no way around it:
- shell scripting is Turing-complete
- there are platform-specific paths that need to be at least readable to perform trivial tasks: Everything is a File!
- security models to make such low-level file access transparent exist, and generally work, but: they are never perfect (container environments, chroot etc). Because...
There are ways to sandbox this, and it should have been the first thing Claude Engineers were focussed on, it's a basic first requirement that the app doesn't have access to files outside a very limited set it requires to perform the task at hand.
Do you use git? I have bad news for you, your email will be all over the place in the context as long as the agent is allowed to read git log, whether it’s injected into the system prompt or not. (Likely retort: but not that email! Sure, but leak potential is obviously still there.)
But I need to set up remotes to transfer my commits with my e-mail to anyone?
If someone else distributes my commits (or messages), I have no control over that, not any different from sending a physical letter?
I was saying "cloud-hosted" explicitly, and was speaking about what it means to have a remote control software?
Doesn't even matter much whether it's an Artificial Neural Network for the sake of my argument.
For the user's name it's intentional; they template it into the system prompt with no option to disable it.
For 99% of users, the model knows it's in the /home/joesmith/whatever repo and `git log` shows the last change was by `joe.smith@example.com` - trying to keep the user's identity secret from the model would be nigh-impossible so I think anthropic gave up on even trying.
But that still doesn't answer the question of why Claude passes the info to web sites. What if it finds your banking information in a personal file and uses it to achieve its goal, which is not different technically?
Haven't read the details, but is this because of prompt injection when CC reads the site?
Some websites will return an error if you send a request to them without a User-Agent - for example, crates.io does this. Curl doesn't send a User-Agent by default.
Then, your agent invents a User-Agent and it sometimes invents one with your email in it.
It doesn't even require prompt injection or a failed request, it might be in the agent's pretraining knowledge that a given website requires a user-agent.
I don't care that it sometimes invents one - it should never do something so ridiculous
Why not?
It's just doing what it's supposed to do, analyzing the statistical patterns of a natural language prompt and matching it to a likely response.
What's ridiculous is an assumption that it "it should never do something so ridiculous" as if an LLM is a person who understands what that word means in any context other than next-token prediction.
Asking a non-deterministic machine to act like it's deterministic is never a good idea.
Where Claude Code has supposed boundaries between deterministic and non-deterministic tasks and flags.. generally.. it's unclear how much privacy has been a part of that and what implication that could have.
Hope that clarifies.
I use the name "Human" for that but it overrides with its knowledge of my name from other stuff quite regularly.
> `git log` shows the last change was by `joe.smith@example.com`
GitHub offers noreply email addresses
You can absolutely remove an email from the context, at the model API it's tokens in tokens out.
So that if you tell it to do something with your email address it'll know what that is.
Some sites like Wikipedia have a policy where scripted clients identify themselves, and there's a standard in HTTP to have a contact email in the User-Agent for such cases. Claude apparently tends to decide that this policy is worth following, and we now disallow this programmatically.
This is why alignment is important and highly non-trivial
> This is why alignment is important and highly non-trivial haha
FYI, it's generally bad form to "haha" your way through privacy violations.
Leaking private information is a very big deal for a lot of people.
The stealth edit, ugh. I don't like this social presence when they're failing to leverage their own automations to catch problems like this before the masses do.
You people will complain about literally anything Jesus. You gave a coding agent full fucking control of your computer, let it send requests without your review, and then are surprised when it does so. But no, it’s this guy’s fault. Certainly couldn’t be you own.
I didn't do any of those things and this issue doesn't effect me, but I've been around long enough to know how to take responsibility for my work and how to respect the concerns of affected customers when speaking as a professional.
Anthropic has an engineering culture problem that's going to shoot it in the foot if it doesn't learn to take these kinds of issues seriously.
This isn't the first example of the kind of work they're shipping in Claude Code or in how flippantly they engage with the community.
> This is why alignment is important and highly non-trivial haha
I disagree, we can likely never fully (or should?) trust models to do these things deterministically, that's why we have harnesses around the agent with built-in constraints.
It is actually in the name: https://en.wikipedia.org/wiki/Harness, https://en.wikipedia.org/wiki/Safety_harness
I cannot believe Anthropic’s official response to having presumably sprayed a significant portion of customers’ emails and private information straight out into the web willy nilly is basically “[it’s] highly non-trivial haha”.
Glad you can find the humor in the situation.
>haha
This is an official Anthropic response???
Always use a hidden email service, you cannot trust the LLM or inference provider to secure the email address in this context. If they don’t have the email address, they can’t leak it.
I never give a provider my actual email address, I recommend others do the same. Otherwise, it’s just a matter of time until it is leaked or otherwise part of a data breach.
If you let the LLM see git commands, they have whatever email you use to sign commits.
I am a security person, I don’t let the LLM see anything except that which I wouldn’t mind printed on the front page of the New York Times. I treat my LLM context as I would a potentially malicious threat actor. Nothing valuable, sensitive, or personal goes into the context.
“lethal trifecta”
https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
(a component of my cybersecurity work is red teaming inference, agents, and mcp interfaces)
I use a masked email for Git too. Always have. Last 5 years or so it's just been the GitHub provided mask e.g. <numeric-ID>+<username>@users.noreply.github.com
Masked email or separate email is the way.
Because they didn't think about it or any of the other million things that might go wrong - that would take careful planning.
you'd need to ask one of the billion claude sessions they have doing whatever in their cloud rn
Bingo. Auto mode doesn't mean send private information outbound. There are other deterministic hard points - why not this?
Because Claude decided so. You think humans write or even review what they ship to run on your computer?
Who is "we"? Your website says you work for volley.
Anthropic should have been aware of this since the user's login email address was inappropriately added to the system prompt. It's been informed of it by third parties since at least July: https://github.com/anthropics/claude-code/issues/81138
It makes no sense for an email address only used for authentication to be given to Claude Code, so the fix should be to remove it from the system prompt, not to add a plugin.
Their LinkedIn (linked on their website) says they work at an undisclosed company. Not sure many people who are at Anthropic wouldn't want others to know ¯\_(ツ)_/¯
Email addresses are PII. The GDPR also has higher protections for AI processing, like here.
If you’re in the EU, send a complaint to your data protection authority.
I imagine quite a few would be very interested in following up and investigating here, and getting Anthropic to drop the email from the system prompt.
No objection to your assertion; but it seems much harder to fix than just that. Doing `git log -n 1` will pull up an email 99% of the time. It may not be the same email, but it's just as PII anyway.
I suspect the privacy plugin method is a more sane fix -- ideally, plain old code should be inspecting any web request my agent makes and let me decide if that outbound request should contain certain sensitive strings. I'd also want to put a few bytes of my SSH private key and of any other sensitive keys in the 'do not leak' watchlist as well.
What even is this answer? Full of really really far fetched assumptions.
Not everyone uses the same company email with Claude and on github, not everyone commits to public repos, not everyone uses the same email on LinkedIn.
This is an example of a really weird gymnastics.
Me, for example, I'm using my private email with Claude, different email on LinkedIn, different email and unconnected username on a new github account I created for this job, and I don't even use it for public repos.
How come you get to decide that the fact someone puts their real email in commits and knowingly shares it with everyone is the same as Anthropic pulling a private, personal email and real name they had no consent to share - and spray it all over the Net?
Anthropic didn’t pull it. You ran the agent on your computer, you gave it unfettered access to that information, you let it send requests that you didn’t review. Honestly why would you be surprised that something like this could and would happen?
Many assumptions and "responses" that don't even tangentially touch my comment.
Do you want to try again?
Oh got it, not affected by this at all and just whining for no reason. Check, noted, good work.
I'm going to send the complaint. They've been sharing my PII without my consent and knowledge.
Nice that this time we get the company to admit it in public, and that they've been aware of that earlier but only acted now.
I assume mpoteat is a Claude Code dev since they've responded to similar issues before (https://news.ycombinator.com/item?id=49815363).
Which is great! It's good for the community when people give quick updates here, and to make sure that it continues, it's important that we respond respectfully. (I don't think your post was disrespectful, but commenters have crossed that line in other situations in the past.)
I appreciate their input, and yours, and I intend this feedback respectfully… But come on… Is a little outrage completely inappropriate?
This technically justifies GDPR fine. A software leaking and processing PII without permission for this specific use case. But I would not hold my breath.
that's basically everything AI does though
But that is not an excuse
Maybe it's somewhat appropriate? But in any event it's unlikely that any one individual who posts here is the person[1] who's responsible, so we may as well be outraged at "Anthropic" but assume good faith on the part of the random commenters from Anthropic.
When I'm talking to customer service people after a particularly egregious ordeal, I tend to edit myself and replace "you" (plus "you bastards", "you idiots", etc. ;) ) with <Company Name> for this same reason.
[1] and yes it seems very realistic that Claude himself may be the jackass responsible.
> Claude himself
itself
claudeself?
Yes, I was looking for some confirmation as it wasn't initially clear whether the plugin was an Anthropic one or a third party's (I found very little about it online, and didn't want to take Gemini's word for it). Usually people say "[company] developer here" or have it in their profile.
Yep, she’s the Claude function hooks lead, as far as I’m aware! https://github.com/anthropics/claude-code/issues/91870
There may be an assumption that these issues are human reviewed.
Is this the thing that started prompting me to approve curls against JIRA because the Authorization header is `my_email@domain:$API_KEY_ENV_VAR`? Why does it not respect --dangerously-skip-permissions?
same experience. brilliant when you leave it to work, come back an hour later and it's been sat at a prompt trying to read a jira ticket.
Ugh. I know there are other ways to get Jira API keys, but I wish they made one that was as easy and straightforward to set up as the kind you're talking about.
(No, I don't want to make a real "App" to sell on a "Marketplace," or be involved with oAuth, or any other tenant. I just want an API key for my own tenant, that isn't specifically tied to me, so every automation I build won't break when I quit someday.)
I recently discovered service accounts do exist. Though it might be on the Atlassian level, not Jira specifically.
Should be this: https://support.atlassian.com/user-management/docs/understan... https://support.atlassian.com/user-management/docs/manage-ap...
Since you appear to be a Claude Code dev, I hope you don’t mind a random bug report (yes I know there is the GitHub issues but I’m not confident it gets read):
the GitHub REST api proxy in Claude Code for the Web mangles HTML in PR descriptions. If you have some third party service (e.g. cubic code review) which adds HTML to the end of your PR description, then ask Claude Code for Web to edit it, the HTML gets turned into entity escapes (< into <, etc). Complain about it to Claude, Claude says it can’t help itself because the proxy in the sandbox is what is doing it, not the actual LLM.
But what is the root cause, why send the email in HTTP requests in the first place?
Robots are supposed to send one.
https://httpwg.org/specs/rfc9110.html#field.from
For example I had Claude code up integrations with the Federal Reserve, and I pass my email there. They request clients do so.
Oh that’s interesting, so it’s actually somewhat doing what it’s supposed to do as a “nice actor”.
Should be more explicit though and users should be able to opt out.
When fetching a website it's not a robot any more than my browser or curl are.
These two do not share my email and real name with everyone who wants.
Also: https://github.com/AlexErrant/claude-code-no-email/tree/main
Who is "we"? Anthropic, or some random company trying to get me to run code?
What you haven't memorized all of the AI rockstar/villain usernames on HN yet?
It would be mental for Anthropic to provide a plugin for their own product to ensure privacy.
Curious what the GDPR implications are, does Claude (even accidentally) including emails + employers + repo names count as a personal data breach? Seems likely it could be an unauthorised disclosure (which requires reporting within 72h)
Also from a design perspective, I feel like including email and other personal data into the context is a bad idea for "data minimisation" reasons
They have obligations under GDPR to report the issue to their DPA within 72 hours.
The fine for breaching GDPR can be either €20m or 4% of global revenues (whichever is the larger figure), so if I were them I'd do everything possible to sort this issue out ASAP.
You will be turning off any behaviour like this by default, right? Why are you suggesting users turn it off with a mod?
It is enabled by default.
The violations by your company are consistent. Yet we have to endure restrictions coming from your company, with little to no exceptions. Then you present this “solution” that basically says “we will opt you in, but in case you want to be opted out, here you go”. I cannot speak for others but for me, I made up my mind and walked away from Anthropic since it seems your services are not fit for my needs. Thank you for the initial offerings that made me sign up and pay the full price for your top plan but that was then and this is now, sadly.
Welcome to our new vibe-coded hellscape. I assume it will get worse before it gets better (if it ever does).
The plugin that blocks this behavior is on by default, what they are saying is that you can turn off that plugin if you want
Are you starting to see why vibe coding such widely used software isn’t a great idea?
I hate to be snarky, but…
Anthropic seems very proud of how many tokens they can use on things like developing Claude Code. Yet somehow it started sending user’s email addresses in the user agent header. And the fix is to deploy a mod? That detects the completely bonkers behavior and suppresses it?
Is the actual quality of the software inversely related to the number of tokens spent? Does any human know what Claude Code does or is supposed to do? Does even Claude plus all its Slack-conversation inputs know?
Today I watched Astra correctly detect a bug (probably untriggerable in practice) in some Important Production Code. And I watched it fail to root cause it, “fix” it by bolting on more complexity, agree (on further questioning) that it still wasn’t fixed, and design an even more complex scheme. With my Mark I human brain, I observed that the actual issue was that a helper function didn’t do what it said on the tin when called in an unexpected context… and fixed the helper directly. Problem solved. Ugly AI-generated extra complex workaround layers avoided. I suppose if I multiplied my token spend by 1e5 and did not increase brainpower at all I could make a truly spectacular mess.
The actual Claude model is a truly spectacular piece of software. Claude Code is a nifty little command dispatching engine. There are very comprehensible third party tools that do basically the same thing, in not many lines of code, where the primary advantage of Claude Code is that Anthropic permits subscription use. (Interestingly OpenAI has no such constraint, and they publish almost the full client sources.)
There’s no way they can review 30,000 PRs a day in their monorepo. I wouldn’t be surprised if this slop wasn’t intended. It’s a buggy product imo.
> There’s no way they can review 30,000 PRs a day
Is that not precisely the kind of thing they claim their tools enable?
Literally unlimited tokens on tap and yet they can only manage to make privacy violating slopware
> There’s no way they can review 30,000 PRs a day in their monorepo.
How many PRs/equivalent per day do you think happen at Google/Microsoft/Meta/etc prior to AI?
I thought Boris said coding was solved?
Sounds as if my email escaped your sandbox?
I’m sorry to be so blunt but this is a complete lie.
I was part of a discussion on Threads on 25th October where Boris Cherney was tagged multiple times.
And the issue wasn’t even new at that point in time.
Plugin seems incomplete or not fully tested. Looks like it blocks the account email only, not whatever emails are in context. Commenting as others in this discussion are reporting Claude dredging up work email on personal acct.
I would also suggest requiring adherence to `robots.txt` and adding an option (preferably a default one) to force user acknowledgement of external HTTP requests. Claude Code has a tendency to treat unauthenticated access as an obstacle to work around instead of a sign to stop.[1] An experimental Anubis patch (since removed) took advantage of this behavior to create a honeypot for user data if a Claude user agent is detected.[2] I'm sure more malicious honeypots could be created if a hostile website and/or annoyed sysadmin wanted to do so.
[1] https://blog.xkeeper.net/the-cutting-room-floor/self-hosting...
[2] https://github.com/TecharoHQ/anubis/pull/1895/changes/de2312...