Hacker News

points by mpoteat 2 days ago | 0 comments

Hi folks. We were initially aware of this a few days ago when this problem started popping off on Reddit, and we introduced a built-in mod called `cc-plugin-privacy` to deterministically block this behavior.

If you're on 2.1.317 or later, you'll have this check included. You can turn it off via /plugins.

[–] cautiouscat 2 days ago

This has been on hackernews before, months ago[1]. How is it just being found now?

1: https://news.ycombinator.com/item?id=50286306

2: https://news.ycombinator.com/item?id=49258881

[–] tmpz22 2 days ago

Of the same ilk Claude code will make PRs on your behalf, using a vague consent prompt that when it happened to me was subtle and easily.

Best practice will forever be to enforce your guard rails in addition to Anthropics guardrails.

[–] RossBencina 2 days ago

Calling them guardrails scares me. I want to hear about deterministic safety interlocks.

Can anyone recommend a reliable 3rd-party audited guide that describes Claude Code's built-in capability gating infrastructure?

Whenever I ask users of claude code how claude controls actions they don't seem to be able to distinguish between what just goes into LLM context (e.g. as a "don't do X" system prompt) and what is gated behind a deterministic capabilities layer.

[–] smashed 2 days ago

The default is "auto mode" where another non-deterministic model compares what the user requested with what the model wants to run and blocks if there is a mismatch.

It will block an "rm" call if your prompt did not include anything about "deleting something".

It mainly protects benign errors. It's completely broken against malicious actors. The model itself will suggest work arounds against its own auto classifier to the user, in order to reach its goal.

[–] hkalbert71 2 days ago

I haven't found a comprehensive independent code audit of Claude Code's full permission implementation.

Anthropic's documentation does distinguish permission rules and pre-tool hooks from model instructions. It also documents OS-enforced sandboxing for shell commands, which has a narrower scope than all agent actions.

An independent stress-test of Auto mode is available here: https://arxiv.org/abs/2604.04978. It's a behavioral evaluation, not a source-code audit.

The important question is whether every state-changing action passes through an enforceable boundary before execution, including indirect actions through file edits or scripts. Post-execution validation is a separate control.

[–] vasco 2 days ago

A claude hook prevents this every time

[–] rvz 2 days ago

According to vibe coders, the future is never reading what the code actually does. You just trust coding agents with everything and "give into the vibes" even when it "says" its correct.

Offshoring understanding is the trend that many companies will pay in the form of comprehension debt.

[–] wellcodeisnot 1 day ago

That's not because "vibes" but because focusing on "code" is the wrong level of abstraction altogether. It always was. We just didn't have the technology to let it go, but now we do.

Code is a reflection. Of what? Look there. Code itself is useless.

[–] augment_me 2 days ago

I mean it's a fair take, your email is probably leaked anyways. Mine is breached 32 times on HaveIBeenPwned with various passwords. Who cares at this point really it's just an inconvenience

[–] xpct 2 days ago

I'm happy to say that my main email that I've been using for 15+ years hasn't been leaked, because I've been very careful on how I share it. Getting it leaked by Claude would suck.

[–] skinfaxi 2 days ago

You wouldn't share it here though right? So there is some level of care?

[–] augment_me 2 days ago

I wouldn't share it here to not be able to have the average person link me with my work as some opinions expressed would perhaps get me in trouble, beyond that no there is no care, it's on my website, it's on my work profile page already, scrape and spam.

[–] teiferer 2 days ago

Anything you wouldn't do yourself you'd not be comfortable CC doing on your behalf, right? So, you do care.

[–] augment_me 2 days ago

CC does not share(and does not have access to) my personal thought, opinions and other things than can affect my employment that I might want to share anonymously.

I am not sure what is hard about this distinction to grasp, why would it matter if CC shared my email if I share my email on my own websites?

[–] olmo23 1 day ago

According to C-programmers, the future is never reading the assembly that the compiler actually generates. You just trust the compiler with everything and "give into the vibes" even when it "says" it's correct.

(sorry, i think you make a good point, ... but i could not resist.)

[–] ryandrake 2 days ago

Bro you just have to tell it "make no mistakes!"

[–] bdangubic 2 days ago

mistake is in the eyes of the beholder ;)

[–] pembrook 2 days ago

This reminds of the open issue on the Claude MacOS app where the OS-wide voice dictation keyboard shortcut function doesn't work.

Somebody on Reddit figured out they just forgot to add a single line permission request into the app. It's been broken now for months.

I just find this wildly hilarious given the 'world ending all powerful AGI is here' rhetoric they're running with at the same time.

Maybe before worrying about permanent 15% GDP growth or human annihilation, what if we started by putting an agent on user issues and solving them pro-actively?

I know the kool aid is tasty, but we might be getting a bit ahead of ourselves here guys. You can fantasize about human annihilation after you figure out how to make a desktop app that doesn't have obvious bugs, I promise :)

[–] wellcodeisnot 1 day ago

You're not wrong, per se, but I think you are not comprehending what will happen next. You think nobody sees this? You think nobody is aware that it's the humans in the process that are holding everything back?

Sure you can have an issue tracker with 1000 items and yes, you can have a bot solve them all in a day, but who monitors it? Who gets to say what he did at the standup? Who reports to whom and what?

Code is not the bottleneck (if it ever was..)

[–] pembrook 1 day ago

So if the leading frontier AI company are struggling to remove human gatekeepers from slowing down the process, how do you think this will go across the rest of the economy?

Will Northrop Grumman, the state government of Alaska, the construction industry, etc. somehow magically move faster than Anthropic?

[–] yesthatstrue 1 day ago

Not sure. Once that particular ball gets rolling I’m not sure how fast it’ll go.

Not saying the current crop of AI companies is going to make it but the tech itself isn’t going away.

[–] qlte 2 days ago

Yeah it's legit weird for the whole narrative to see Claude Code/Codex repos with thousands of open issues. With certain issues full of +1 reactions and "still happening in 2.21.2" replies.

But instead of a Software Dev as a Service triaging/implementing/merging fixes 24/7 and clearing the backlog as they come in, they just sit there for days to weeks until a GitHub bot closes then as duplicates, generating more unhappy user replies and new issues to go unaddressed.

[–] tedd4u 2 days ago

Aren’t we supposed to be able to just point Claude at the bugs and rip through them?

[–] il 2 days ago

Why was this the default behavior in the first place?

[–] toomuchtodo 2 days ago

Always use a hidden email service, you cannot trust the LLM or inference provider to secure the email address in this context. If they don’t have the email address, they can’t leak it.

I never give a provider my actual email address, I recommend others do the same. Otherwise, it’s just a matter of time until it is leaked or otherwise part of a data breach.

[–] komali2 2 days ago

If you let the LLM see git commands, they have whatever email you use to sign commits.

[–] ceuk 2 days ago

I use a masked email for Git too. Always have. Last 5 years or so it's just been the GitHub provided mask e.g. <numeric-ID>+<username>@users.noreply.github.com

[–] soraminazuki 4 hours ago

That won't save you in this case because that email address still identifies you. It's an anti-spam measure, not a privacy measure.

[–] j45 2 days ago

Masked email or separate email is the way.

[–] toomuchtodo 2 days ago

I am a security person, I don’t let the LLM see anything except that which I wouldn’t mind printed on the front page of the New York Times. I treat my LLM context as I would a potentially malicious threat actor. Nothing valuable, sensitive, or personal goes into the context.

“lethal trifecta”

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

(a component of my cybersecurity work is red teaming inference, agents, and mcp interfaces)

[–] moritzwarhier 2 days ago

I'd guess it's simply because it tried to use the context to achieve the goal.

Guarding PII is an extra, I guess, and if you want to use a giant cloud-hosted NN to control software on your own device, there are very few default restrictions. And no matter what restrictions there are, when they go beyond prompting, they would have their own ShowHN.

[–] teamonkey 2 days ago

Why is the login information even allowed to touch the context?

[–] michaelt 2 days ago

For the user's name it's intentional; they template it into the system prompt with no option to disable it.

For 99% of users, the model knows it's in the /home/joesmith/whatever repo and `git log` shows the last change was by `joe.smith@example.com` - trying to keep the user's identity secret from the model would be nigh-impossible so I think anthropic gave up on even trying.

[–] hyperhello 2 days ago

But that still doesn't answer the question of why Claude passes the info to web sites. What if it finds your banking information in a personal file and uses it to achieve its goal, which is not different technically?

[–] CharlieDigital 2 days ago

Haven't read the details, but is this because of prompt injection when CC reads the site?

[–] tempaccount420 2 days ago

Some websites will return an error if you send a request to them without a User-Agent - for example, crates.io does this. Curl doesn't send a User-Agent by default.

Then, your agent invents a User-Agent and it sometimes invents one with your email in it.

It doesn't even require prompt injection or a failed request, it might be in the agent's pretraining knowledge that a given website requires a user-agent.

[–] caturopath 2 days ago

I use the name "Human" for that but it overrides with its knowledge of my name from other stuff quite regularly.

[–] TuxSH 2 days ago

> `git log` shows the last change was by `joe.smith@example.com`

GitHub offers noreply email addresses

[–] woopsn 2 days ago

You can absolutely remove an email from the context, at the model API it's tokens in tokens out.

[–] zbentley 2 days ago

I can think of tons of common prompts and tasks for which the AI being easily able to introspect subscriber details would be very useful.

Wish that were itself behind a permission wall, but I guess everyone just uses auto mode anyway so perhaps that ship has sailed.

[–] moritzwarhier 2 days ago

This was indeed the friction i meant, but I was too lazy to elaborate.

Common problem: you might consider it trivial to define a rule that forbids access to any file path outside the working directory. Allowing "safe" shell access is already a heuristic, there is no way around it:

- shell scripting is Turing-complete

- there are platform-specific paths that need to be at least readable to perform trivial tasks: Everything is a File!

- security models to make such low-level file access transparent exist, and generally work, but: they are never perfect (container environments, chroot etc). Because...

[–] grey-area 2 days ago

There are ways to sandbox this, and it should have been the first thing Claude Engineers were focussed on, it's a basic first requirement that the app doesn't have access to files outside a very limited set it requires to perform the task at hand.

[–] teamonkey 2 days ago

I can’t think of any, to be honest. It could have access to a parcel that contains some of the subscriber information, but there’s no reason it needs to know how to log in to itself.

[–] oefrha 2 days ago

Do you use git? I have bad news for you, your email will be all over the place in the context as long as the agent is allowed to read git log, whether it’s injected into the system prompt or not. (Likely retort: but not that email! Sure, but leak potential is obviously still there.)

[–] moritzwarhier 2 days ago

But I need to set up remotes to transfer my commits with my e-mail to anyone?

If someone else distributes my commits (or messages), I have no control over that, not any different from sending a physical letter?

I was saying "cloud-hosted" explicitly, and was speaking about what it means to have a remote control software?

Doesn't even matter much whether it's an Artificial Neural Network for the sake of my argument.

[–] cowlevel 2 days ago

So that if you tell it to do something with your email address it'll know what that is.

[–] j45 2 days ago

Bingo. Auto mode doesn't mean send private information outbound. There are other deterministic hard points - why not this?

[–] mpoteat 2 days ago

Some sites like Wikipedia have a policy where scripted clients identify themselves, and there's a standard in HTTP to have a contact email in the User-Agent for such cases. Claude apparently tends to decide that this policy is worth following, and we now disallow this programmatically.

This is why alignment is important and highly non-trivial

[–] swatcoder 2 days ago

> This is why alignment is important and highly non-trivial haha

FYI, it's generally bad form to "haha" your way through privacy violations.

Leaking private information is a very big deal for a lot of people.

[–] BowBun 2 days ago

The stealth edit, ugh. I don't like this social presence when they're failing to leverage their own automations to catch problems like this before the masses do.

[–] phoghed 2 days ago

You people will complain about literally anything Jesus. You gave a coding agent full fucking control of your computer, let it send requests without your review, and then are surprised when it does so. But no, it’s this guy’s fault. Certainly couldn’t be you own.

[–] swatcoder 2 days ago

I didn't do any of those things and this issue doesn't effect me, but I've been around long enough to know how to take responsibility for my work and how to respect the concerns of affected customers when speaking as a professional.

Anthropic has an engineering culture problem that's going to shoot it in the foot if it doesn't learn to take these kinds of issues seriously.

This isn't the first example of the kind of work they're shipping in Claude Code or in how flippantly they engage with the community.

[–] h0rv 2 days ago

> This is why alignment is important and highly non-trivial haha

I disagree, we can likely never fully (or should?) trust models to do these things deterministically, that's why we have harnesses around the agent with built-in constraints.

It is actually in the name: https://en.wikipedia.org/wiki/Harness, https://en.wikipedia.org/wiki/Safety_harness

[–] echoangle 2 days ago

Glad you can find the humor in the situation.

[–] christina97 2 days ago

I cannot believe Anthropic’s official response to having presumably sprayed a significant portion of customers’ emails and private information straight out into the web willy nilly is basically “[it’s] highly non-trivial haha”.

[–] cluckindan 2 days ago

>haha

This is an official Anthropic response???

[–] LastTrain 2 days ago

Because they didn't think about it or any of the other million things that might go wrong - that would take careful planning.

[–] rplnt 2 days ago

Because Claude decided so. You think humans write or even review what they ship to run on your computer?

[–] c0rruptbytes 2 days ago

you'd need to ask one of the billion claude sessions they have doing whatever in their cloud rn

[–] mkl 2 days ago

Who is "we"? Your website says you work for volley.

Anthropic should have been aware of this since the user's login email address was inappropriately added to the system prompt. It's been informed of it by third parties since at least July: https://github.com/anthropics/claude-code/issues/81138

It makes no sense for an email address only used for authentication to be given to Claude Code, so the fix should be to remove it from the system prompt, not to add a plugin.

[–] dang 2 days ago

I assume mpoteat is a Claude Code dev since they've responded to similar issues before (https://news.ycombinator.com/item?id=49815363).

Which is great! It's good for the community when people bring first-hand updates here, and to make sure that it continues, it's important that we respond respectfully. (I don't think your post was disrespectful, but commenters have crossed that line in other situations in the past.)

[–] btown 2 days ago

Yep, she’s the Claude function hooks lead, as far as I’m aware! https://github.com/anthropics/claude-code/issues/91870

[–] joshjdr 2 days ago

I appreciate their input, and yours, and I intend this feedback respectfully… But come on… Is a little outrage completely inappropriate?

[–] dang 1 day ago

No, I agree, but it hinges on what you call "a little".

If you take into account that most people underestimate their own provocations by (say) 10x and overestimate those of others by (say) another 10x, that compounds to quite a skew. This can, and often does, plunge discussion into internet failure modes like rage fests and outright mob dynamics.

It's therefore best to temper one's indignation with some kind of alloy (as you did in your comment here) and not go full uninhibited. I know that's countercultural, counterintuitive, and unsatisfying, but it's the right tradeoff for this site, given what we're trying to optimize for.

[–] xp84 2 days ago

Maybe it's somewhat appropriate? But in any event it's unlikely that any one individual who posts here is the person[1] who's responsible, so we may as well be outraged at "Anthropic" but assume good faith on the part of the random commenters from Anthropic.

When I'm talking to customer service people after a particularly egregious ordeal, I tend to edit myself and replace "you" (plus "you bastards", "you idiots", etc. ;) ) with <Company Name> for this same reason.

[1] and yes it seems very realistic that Claude himself may be the jackass responsible.

[–] usefulcat 2 days ago

> Claude himself

itself

[–] pm3003 2 days ago

claudeself?

[–] nicce 2 days ago

This technically justifies GDPR fine. A software leaking and processing PII without permission for this specific use case. But I would not hold my breath.

[–] cowlevel 2 days ago

that's basically everything AI does though

[–] nicce 1 day ago

But that is not an excuse

[–] mkl 2 days ago

Yes, I was looking for some confirmation as it wasn't initially clear whether the plugin was an Anthropic one or a third party's (I found very little about it online, and didn't want to take Gemini's word for it). Usually people say "[company] developer here" or have it in their profile.

[–] dannyw 2 days ago

Email addresses are PII. The GDPR also has higher protections for AI processing, like here.

If you’re in the EU, send a complaint to your data protection authority.

I imagine quite a few would be very interested in following up and investigating here, and getting Anthropic to drop the email from the system prompt.

[–] subscribed 2 days ago

I'm going to send the complaint. They've been sharing my PII without my consent and knowledge.

Nice that this time we get the company to admit it in public, and that they've been aware of that earlier but only acted now.

[–] xp84 2 days ago

No objection to your assertion; but it seems much harder to fix than just that. Doing `git log -n 1` will pull up an email 99% of the time. It may not be the same email, but it's just as PII anyway.

I suspect the privacy plugin method is a more sane fix -- ideally, plain old code should be inspecting any web request my agent makes and let me decide if that outbound request should contain certain sensitive strings. I'd also want to put a few bytes of my SSH private key and of any other sensitive keys in the 'do not leak' watchlist as well.

[–] subscribed 2 days ago

What even is this answer? Full of really really far fetched assumptions.

Not everyone uses the same company email with Claude and on github, not everyone commits to public repos, not everyone uses the same email on LinkedIn.

This is an example of a really weird gymnastics.

Me, for example, I'm using my private email with Claude, different email on LinkedIn, different email and unconnected username on a new github account I created for this job, and I don't even use it for public repos.

How come you get to decide that the fact someone puts their real email in commits and knowingly shares it with everyone is the same as Anthropic pulling a private, personal email and real name they had no consent to share - and spray it all over the Net?

[–] phoghed 2 days ago

Anthropic didn’t pull it. You ran the agent on your computer, you gave it unfettered access to that information, you let it send requests that you didn’t review. Honestly why would you be surprised that something like this could and would happen?

[–] subscribed 2 days ago

Many assumptions and "responses" that don't even tangentially touch my comment.

Do you want to try again?

[–] phoghed 1 day ago

Oh got it, not affected by this at all and just whining for no reason. Check, noted, good work.

[–] j45 2 days ago

There may be an assumption that these issues are human reviewed.

[–] godelski 2 days ago

Their LinkedIn (linked on their website) says they work at an undisclosed company. Not sure many people who are at Anthropic wouldn't want others to know ¯\_(ツ)_/¯

[–] taspeotis 2 days ago

Is this the thing that started prompting me to approve curls against JIRA because the Authorization header is `my_email@domain:$API_KEY_ENV_VAR`? Why does it not respect --dangerously-skip-permissions?

[–] xp84 2 days ago

Ugh. I know there are other ways to get Jira API keys, but I wish they made one that was as easy and straightforward to set up as the kind you're talking about.

(No, I don't want to make a real "App" to sell on a "Marketplace," or be involved with oAuth, or any other tenant. I just want an API key for my own tenant, that isn't specifically tied to me, so every automation I build won't break when I quit someday.)

[–] giladd 2 days ago

I recently discovered service accounts do exist. Though it might be on the Atlassian level, not Jira specifically.

Should be this: https://support.atlassian.com/user-management/docs/understan... https://support.atlassian.com/user-management/docs/manage-ap...

[–] alsiola 2 days ago

same experience. brilliant when you leave it to work, come back an hour later and it's been sat at a prompt trying to read a jira ticket.

[–] skissane 2 days ago

Since you appear to be a Claude Code dev, I hope you don’t mind a random bug report (yes I know there is the GitHub issues but I’m not confident it gets read):

the GitHub REST api proxy in Claude Code for the Web mangles HTML in PR descriptions. If you have some third party service (e.g. cubic code review) which adds HTML to the end of your PR description, then ask Claude Code for Web to edit it, the HTML gets turned into entity escapes (< into <, etc). Complain about it to Claude, Claude says it can’t help itself because the proxy in the sandbox is what is doing it, not the actual LLM.

[–] stingraycharles 2 days ago

But what is the root cause, why send the email in HTTP requests in the first place?

[–] paulddraper 2 days ago

Robots are supposed to send one.

https://httpwg.org/specs/rfc9110.html#field.from

[–] subscribed 2 days ago

When fetching a website it's not a robot any more than my browser or curl are.

These two do not share my email and real name with everyone who wants.

[–] stingraycharles 2 days ago

Oh that’s interesting, so it’s actually somewhat doing what it’s supposed to do as a “nice actor”.

Should be more explicit though and users should be able to opt out.

[–] XenophileJKO 2 days ago

For example I had Claude code up integrations with the Federal Reserve, and I pass my email there. They request clients do so.

[–] junofan 2 days ago

Plugin seems incomplete or not fully tested. Looks like it blocks the account email only, not whatever emails are in context. Commenting as others in this discussion are reporting Claude dredging up work email on personal acct.

[–] wewewedxfgdf 2 days ago

Who is "we"? Anthropic, or some random company trying to get me to run code?

[–] gobdovan 2 days ago

It would be mental for Anthropic to provide a plugin for their own product to ensure privacy.

[–] LastTrain 2 days ago

What you haven't memorized all of the AI rockstar/villain usernames on HN yet?

[–] aanet 2 days ago

Also: https://github.com/AlexErrant/claude-code-no-email/tree/main

[–] psc 2 days ago

Curious what the GDPR implications are, does Claude (even accidentally) including emails + employers + repo names count as a personal data breach? Seems likely it could be an unauthorised disclosure (which requires reporting within 72h)

Also from a design perspective, I feel like including email and other personal data into the context is a bad idea for "data minimisation" reasons

[–] paulbjensen 2 days ago

They have obligations under GDPR to report the issue to their DPA within 72 hours.

The fine for breaching GDPR can be either €20m or 4% of global revenues (whichever is the larger figure), so if I were them I'd do everything possible to sort this issue out ASAP.

[–] codehead 2 days ago

The violations by your company are consistent. Yet we have to endure restrictions coming from your company, with little to no exceptions. Then you present this “solution” that basically says “we will opt you in, but in case you want to be opted out, here you go”. I cannot speak for others but for me, I made up my mind and walked away from Anthropic since it seems your services are not fit for my needs. Thank you for the initial offerings that made me sign up and pay the full price for your top plan but that was then and this is now, sadly.

[–] jaapz 2 days ago

The plugin that blocks this behavior is on by default, what they are saying is that you can turn off that plugin if you want

[–] arcanemachiner 2 days ago

Welcome to our new vibe-coded hellscape. I assume it will get worse before it gets better (if it ever does).

[–] eaurouge 2 days ago

Are you starting to see why vibe coding such widely used software isn’t a great idea?

[–] amluto 2 days ago

I hate to be snarky, but…

Anthropic seems very proud of how many tokens they can use on things like developing Claude Code. Yet somehow it started sending user’s email addresses in the user agent header. And the fix is to deploy a mod? That detects the completely bonkers behavior and suppresses it?

Is the actual quality of the software inversely related to the number of tokens spent? Does any human know what Claude Code does or is supposed to do? Does even Claude plus all its Slack-conversation inputs know?

Today I watched Astra correctly detect a bug (probably untriggerable in practice) in some Important Production Code. And I watched it fail to root cause it, “fix” it by bolting on more complexity, agree (on further questioning) that it still wasn’t fixed, and design an even more complex scheme. With my Mark I human brain, I observed that the actual issue was that a helper function didn’t do what it said on the tin when called in an unexpected context… and fixed the helper directly. Problem solved. Ugly AI-generated extra complex workaround layers avoided. I suppose if I multiplied my token spend by 1e5 and did not increase brainpower at all I could make a truly spectacular mess.

The actual Claude model is a truly spectacular piece of software. Claude Code is a nifty little command dispatching engine. There are very comprehensible third party tools that do basically the same thing, in not many lines of code, where the primary advantage of Claude Code is that Anthropic permits subscription use. (Interestingly OpenAI has no such constraint, and they publish almost the full client sources.)

[–] goalieca 2 days ago

There’s no way they can review 30,000 PRs a day in their monorepo. I wouldn’t be surprised if this slop wasn’t intended. It’s a buggy product imo.

[–] solyin 2 days ago

> There’s no way they can review 30,000 PRs a day in their monorepo.

How many PRs/equivalent per day do you think happen at Google/Microsoft/Meta/etc prior to AI?

[–] wild_egg 2 days ago

> There’s no way they can review 30,000 PRs a day

Is that not precisely the kind of thing they claim their tools enable?

Literally unlimited tokens on tap and yet they can only manage to make privacy violating slopware

[–] grey-area 2 days ago

You will be turning off any behaviour like this by default, right? Why are you suggesting users turn it off with a mod?

[–] paulddraper 2 days ago

It is enabled by default.

[–] dca88 2 days ago

I thought Boris said coding was solved?

[–] baxtr 2 days ago

Sounds as if my email escaped your sandbox?

[–] 00deadbeef 2 days ago

I’m sorry to be so blunt but this is a complete lie.

I was part of a discussion on Threads on 25th October where Boris Cherney was tagged multiple times.

And the issue wasn’t even new at that point in time.

[–] InvisibleUp 2 days ago

I would also suggest requiring adherence to `robots.txt` and adding an option (preferably a default one) to force user acknowledgement of external HTTP requests. Claude Code has a tendency to treat unauthenticated access as an obstacle to work around instead of a sign to stop.[1] An experimental Anubis patch (since removed) took advantage of this behavior to create a honeypot for user data if a Claude user agent is detected.[2] I'm sure more malicious honeypots could be created if a hostile website and/or annoyed sysadmin wanted to do so.

[1] https://blog.xkeeper.net/the-cutting-room-floor/self-hosting...

[2] https://github.com/TecharoHQ/anubis/pull/1895/changes/de2312...