Hacker News new | past | comments | ask | show | jobs | submit
teiferer | on: Claude Code sends your email address to websites
> when you have given the agent access to your password vault

I'm amazed reading that anybody would even consider doing that.

bambax | parent | next
I currently work for a big French company, for which I have developed an "alternate" (emergency and temporary) accounting system because their actual system is broken, and another team is trying to fix it (has been trying to fix it for nine months now).

Said alternate system is a bunch of Python scripts, an sqlite database, and a file containing various API keys to read and write to other company systems; it runs on a dedicated virtual machine.

I share all the code I produce to the other team. But yesterday I found out that the IT department gave the other team full access to my production machine, without my knowledge or consent (which was bad enough), and that the other team gave access to Claude, which has bean roaming free for a while now, on that production machine.

I've thrown a big fit over this; I don't know if I'm over reacting but I think it's insane.

dotancohen | root | parent | next

  > the IT department gave the other team full access to my production machine
Your error is here.

It's not your production machine. It's the company's production machine. Always expect the company to do whatever it wants with its machine, and use the machine accordingly.

bambax | root | parent | next
Yes I understand it's not "my" machine, but it's the dedicated machine my system runs on.

That someone would let an agent run on it at any time, read what's there, and possibly modify the code or stop a process, without even informing me, is what I find problematic, to say the least.

loading story #50389626
tremon | root | parent | next
That's a geography error on your part. Humans in the EU have an expectation of privacy even on work-issued devices, which is backed by various laws.
loading story #50392743
gus_massa | root | parent
I have "my" office at the university.

I expect that I can be relocated to another office with a month of advance notice. Also cleanup, fire security check and fixing water leakage while I'm not there.

I don't expect that someone else will provide the keys of "my" office to the biology department when they have to keep a few sheeps during the weekend.

loading story #50392857
fc417fc802 | root | parent
> I don't know if I'm over reacting but I think it's insane.

Your employer has gone beyond testing in prod to vibecoding live in prod, secrets included. Yes that's completely insane. Perhaps this exact mentality is how the primary system wound up broken in the first place?

bambax | root | parent
Yes, but happily enough for me they're not my "employer", only my client.
CobrastanJorji | parent | next
My friend, there are people are out there telling their AI personal assistants to go on Amazon and purchase a surprise present for themselves based on their known preferences. And then they intentionally do not inspect what the AI purchases because it would ruin the surprise.

People have wildly different risk calculators.

svnt | root | parent
Ordering from Amazon is way less risky than a password vault imo. The password vault does not have a return policy, for starters.

Beyond that, access to logins enables buying things on Amazon, sending emails to everyone you know, registering domain names and spinning up servers, stock trading, etc.

fc417fc802 | root | parent
> The password vault does not have a return policy, for starters.

When a couple thousand dollars worth of perishable food shows up on your doorstep, what then? Not everything on amazon can be returned.

svnt | root | parent
They typically refund food and don’t require you to return it.

If not: still better than giving ai your password vault. I’m not saying it is a good idea to let ai buy from Amazon. I am saying that giving ai access to your password vault is still a superset of letting ai buy from Amazon.

dice | parent
People give them access to email, so they can request password resets and act on them. That's a fun one to think about too!