Anthropic should have been aware of this since the user's login email address was inappropriately added to the system prompt. It's been informed of it by third parties since at least July: https://github.com/anthropics/claude-code/issues/81138
It makes no sense for an email address only used for authentication to be given to Claude Code, so the fix should be to remove it from the system prompt, not to add a plugin.
[–] dang 2 days ago
[–] btown 2 days ago
[–] joshjdr 2 days ago
[–] dang 1 day ago
If you take into account that most people underestimate their own provocations by (say) 10x and overestimate those of others by (say) another 10x, that compounds to quite a skew. This can, and often does, plunge discussion into internet failure modes like rage fests and outright mob dynamics.
It's therefore best to temper one's indignation with some kind of alloy (as you did in your comment here) and not go full uninhibited. I know that's countercultural, counterintuitive, and unsatisfying, but it's the right tradeoff for this site, given what we're trying to optimize for.
[–] xp84 2 days ago
When I'm talking to customer service people after a particularly egregious ordeal, I tend to edit myself and replace "you" (plus "you bastards", "you idiots", etc. ;) ) with <Company Name> for this same reason.
[1] and yes it seems very realistic that Claude himself may be the jackass responsible.
[–] nicce 2 days ago
[–] cowlevel 2 days ago
[–] mkl 2 days ago
[–] dannyw 2 days ago
If you’re in the EU, send a complaint to your data protection authority.
I imagine quite a few would be very interested in following up and investigating here, and getting Anthropic to drop the email from the system prompt.
[–] subscribed 2 days ago
Nice that this time we get the company to admit it in public, and that they've been aware of that earlier but only acted now.
[–] xp84 2 days ago
I suspect the privacy plugin method is a more sane fix -- ideally, plain old code should be inspecting any web request my agent makes and let me decide if that outbound request should contain certain sensitive strings. I'd also want to put a few bytes of my SSH private key and of any other sensitive keys in the 'do not leak' watchlist as well.
[–] subscribed 2 days ago
Not everyone uses the same company email with Claude and on github, not everyone commits to public repos, not everyone uses the same email on LinkedIn.
This is an example of a really weird gymnastics.
Me, for example, I'm using my private email with Claude, different email on LinkedIn, different email and unconnected username on a new github account I created for this job, and I don't even use it for public repos.
How come you get to decide that the fact someone puts their real email in commits and knowingly shares it with everyone is the same as Anthropic pulling a private, personal email and real name they had no consent to share - and spray it all over the Net?
[–] phoghed 2 days ago
[–] subscribed 2 days ago
Do you want to try again?
[–] phoghed 1 day ago
[–] subscribed 1 day ago
But there's also the thing you're either replying to the wrong person (your comment is not relevant in the context of mine), or you just wanted to make an irrelevant statement in what case why would you demand anyone engaging with it?
I hope it was simpler.
Which is great! It's good for the community when people bring first-hand updates here, and to make sure that it continues, it's important that we respond respectfully. (I don't think your post was disrespectful, but commenters have crossed that line in other situations in the past.)