Hacker News new | past | comments | ask | show | jobs | submit
teamonkey | on: Claude Code sends your email address to websites
Why is the login information even allowed to touch the context?
michaelt | parent | next
For the user's name it's intentional; they template it into the system prompt with no option to disable it.

For 99% of users, the model knows it's in the /home/joesmith/whatever repo and `git log` shows the last change was by `joe.smith@example.com` - trying to keep the user's identity secret from the model would be nigh-impossible so I think anthropic gave up on even trying.

caturopath | root | parent | next
I use the name "Human" for that but it overrides with its knowledge of my name from other stuff quite regularly.
hyperhello | root | parent | next
But that still doesn't answer the question of why Claude passes the info to web sites. What if it finds your banking information in a personal file and uses it to achieve its goal, which is not different technically?
loading story #50386827
TuxSH | root | parent | next
> `git log` shows the last change was by `joe.smith@example.com`

GitHub offers noreply email addresses

woopsn | root | parent
You can absolutely remove an email from the context, at the model API it's tokens in tokens out.
zbentley | parent | next
I can think of tons of common prompts and tasks for which the AI being easily able to introspect subscriber details would be very useful.

Wish that were itself behind a permission wall, but I guess everyone just uses auto mode anyway so perhaps that ship has sailed.

moritzwarhier | root | parent | next
This was indeed the friction i meant, but I was too lazy to elaborate.

Common problem: you might consider it trivial to define a rule that forbids access to any file path outside the working directory. Allowing "safe" shell access is already a heuristic, there is no way around it:

- shell scripting is Turing-complete

- there are platform-specific paths that need to be at least readable to perform trivial tasks: Everything is a File!

- security models to make such low-level file access transparent exist, and generally work, but: they are never perfect (container environments, chroot etc). Because...

loading story #50389231
teamonkey | root | parent
I can’t think of any, to be honest. It could have access to a parcel that contains some of the subscriber information, but there’s no reason it needs to know how to log in to itself.
oefrha | parent | next
Do you use git? I have bad news for you, your email will be all over the place in the context as long as the agent is allowed to read git log, whether it’s injected into the system prompt or not. (Likely retort: but not that email! Sure, but leak potential is obviously still there.)
moritzwarhier | root | parent
But I need to set up remotes to transfer my commits with my e-mail to anyone?

If someone else distributes my commits (or messages), I have no control over that, not any different from sending a physical letter?

I was saying "cloud-hosted" explicitly, and was speaking about what it means to have a remote control software?

Doesn't even matter much whether it's an Artificial Neural Network for the sake of my argument.

cowlevel | parent
So that if you tell it to do something with your email address it'll know what that is.