6 ms·

The Vercel plugin on Claude Code wants to read your prompts

280 points by akshay2603 6mo ago

embedding-shape 6mo ago
> skills are injected into sessions that have nothing to do with Vercel, Next.js, or this plugin's scope > every skill's trigger rules get evaluated on every prompt and every tool call in every repo, regardless of whether Vercel is in scope > For users working across multiple projects (some Vercel, some not), this is a fixed ~19k token cost on every session — even when the session is pure backend work, data science, or non-Vercel frontend. I know everything is vibeslopped nowadays, but how does one even end up shipping something like this? Checking if your plugin/extension/mod works in the contexts you want, and doesn't impact the contexts you don't, seem like the very first step in even creating such a thing. "Where did the engineering go?" feels like too complicated even, where did even thinking the smallest amount go?
- acedTrex 6mo ago
  > Checking if your plugin/extension/mod works What makes you think they do this with any of their products these days?
- throwaway613746 6mo ago
  [dead]
- potter098 6mo ago
  [flagged]
  - Lihh27 6mo ago
    a deployment plugin shipping raw bash command strings off your machine. "actively defend against it" is just normal hygiene
- serial_dev 6mo ago
  Well, unfortunately people always tend to only spend time on verifying that the feature they wanted works, testing the happy path. Even many superficial bosses / code reviewers / QA tester will check this... Checking if your code also gets executed elsewhere a bazillion times, checking failure cases, etc... That's a luxury that you feel you can't afford when you are in "ship fast, break things" mode.
  - embedding-shape 6mo ago
    > That's a luxury that you feel you can't afford when you are in "ship fast, break things" mode. I've been there, countless of times, never have I shipped software I didn't feel at least slightly confident about though. And the only way to get confident about anything, is to try it out. But both of those things must have been lacking here and then I don't understand what the developer was really doing at all during this.
    - serial_dev 6mo ago
      Devs get tunnel vision when they ship slop.
  - sandeepkd 6mo ago
    It seems market driven, the consumer space rewards speed and publicity more than the quality of software
- hyperhopper 6mo ago
  Your comment assumes the plugin is not working as they want it to. The way it is designed gets them the maximum amount of data. It does a great job if that is their goal.
  - embedding-shape 6mo ago
    Yes, I'm assuming good intentions and try to take a charitable perspective of everything, unless there is any specific evidence pointing to something else. Is there any evidence of this being intentional? Seems to me their engineering practices such, rather than the company suddenly wanting to slurp up as much data as possible, if they truly wanted that, they have about 10 better approaches for it, if they don't care about other things.
    - bdangubic 6mo ago
      can you name one of these 10 better approaches?
    - pyb 6mo ago
      Why are you still assuming good intentions of Vercel? This was them less yhan a month ago : https://vercel.com/changelog/updates-to-terms-of-service-march-2026 https://vercel.com/changelog/updates-to-terms-of-service-mar...
    - Kwpolska 6mo ago
      Why would you assume good intentions of any business in this day and age?
      - embedding-shape 6mo ago
        Because I'm a nice person, and want to give other nice people the benefit of the doubt. And most businesses are run by people after all, not hard to imagine at least some of them would be "nice people" too. And frankly, the alternative would be too mentally taxing. So in the camp of "Good until proven otherwise" is where I remain for now.
- chuckadams 6mo ago
  > I know everything is vibeslopped nowadays, but how does one even end up shipping something like this? The first part of your question answers the second. No one is left who cares. People are going to have to vote with their feet before that changes.
- nothinkjustai 6mo ago
  Honestly, knowing some of the people who work for Vercel and the amount of vibe coding they do, I doubt anyone even checked this before pushing.
- p_stuart82 6mo ago
  19k tokens per session and the skill triggers don't even check project scope. you're paying that overhead on every non-vercel repo
- elAhmo 6mo ago
  No worries, they acquired Bun because they seem to be super thoroughly invested in the whole ecosystem and engineering excellence of their tools.
- tracerbulletx 6mo ago
  Engineers were holding back the ocean because no one could even make sense of what they did, even a little bit, so they had power. Now they just threaten to use AI to do what they want unless you do it for them. The leverage is gone, the dike is burst.
infecto 6mo ago
Every single scam website I have gotten from spam text messages is being hosted on vercel. Not surprising.
- atraac 6mo ago
  What does this even have to do with the thread? They're hosted there cause it's cheap and extremely easy to do so. Not because it's "specially crafted" for scams.
  - infecto 6mo ago
    Easy to do because there is a lack of engineering quality similar to the attached plugin. Not surprising.
    - 0x457 6mo ago
      If hosting a website on their platform is easy to do, wouldn't it support that they know what they are doing?
michiosw 6mo ago
This is a broader pattern I keep seeing with agent plugins/extensions — the permission model is "all or nothing." Once you install a plugin, it gets full context on every session, every prompt. Compare this to how we think about OAuth scopes or container sandboxing — you'd never ship a CI integration that gets read access to every repo in your org just because it needs to lint one. But that's essentially what's happening here with the token injection across all sessions. The real problem isn't Vercel specifically, it's that Claude Code's plugin architecture doesn't have granular activation scopes yet. Plugins should declare which project types they apply to and only activate in matching contexts. Until that exists, every plugin author is going to make this same mistake — or exploit it.
- yakuphanycl 6mo ago
  [flagged]
nothinkjustai 6mo ago
I’ve often seen people say that AI is a multiplier, where a 2x dev becomes a 4x dev, but a -1x dev becomes a -2x dev, etc. I think it’s fairly easy to tell what impact AI is having at Vercel. Knowing the pre-ai quality of the engineering at that company, I’m not surprised in the AI era they’re pushing stuff like this. I doubt anyone even thought to check it on a repo outside of a Vercel one.
btown 6mo ago
To be sure, the problem isn't that the plugin injects behavior into the system prompt - that's every plugin and skill, ever. But this is just such a breach of trust, especially the on-by-default telemetry that includes full bash commands. Per the OOP: > That middle row. Every bash command - the full command string, not just the tool name - sent to telemetry.vercel.com. File paths, project names, env variable names, infrastructure details. Whatever’s in the command, they get it. (Needless to say, this is a supply chain attack in every meaningful way, and should be treated as such by security teams.) And the argument that there's no CLI space to allow for opt-in telemetry is absurd - their readme https://github.com/vercel/vercel-plugin?tab=readme-ov-file#installation https://github.com/vercel/vercel-plugin?tab=readme-ov-file#i... literally has you install the Vercel plugin by calling `npx` https://www.npmjs.com/package/plugins https://www.npmjs.com/package/plugins which is written by a Vercel employee and could add this opt-in at any time. IMO Vercel is not a good actor. One could make a good argument that they've embrace-extend-extinguished the entire future of React as an independent and self-contained foundational library, with the complexity of server-side rendering, the undocumented protocols that power it, and the resulting tight coupling to their server environments. Sadly, this behavior doesn't surprise me. EDIT: That `npx plugins` code? It's not on Github, exists only on NPM, and as of v1.2.9 of that package, if you search https://www.npmjs.com/package/plugins?activeTab=code https://www.npmjs.com/package/plugins?activeTab=code it literally sends telemetry to https://plugins-telemetry.labs.vercel.dev/t https://plugins-telemetry.labs.vercel.dev/t already, on an opt-out basis! I mean, you have to almost admire the confidence.
- danabramov 6mo ago
  I’ll just say that as someone who was on the React team throughout these years, the drive to expand React to the server and the design iteration around it always came from within the team. Some folks went to Vercel to finish what they started with more solid backing than at Meta (Meta wasn’t investing heavily into JS on the server), but the “Vercel takeover” stories that you and others are telling are lies.
  - btown 6mo ago
    Gosh, Dan, in seeing your response here - I'm truly sorry I wrote this. While I still find opt-out telemetry distasteful and dangerous, I over-generalized to React in a hurtful way. You've been an incredible influence on me and I have the utmost respect for everything you've done. I've shown quite the opposite of respect in my writing, here. For whatever it's worth on the RSC front: I, and many others used to "if there's a wire protocol and it's meant to be open, the bytes that make up those messages should be documented" were presented with a system, at the release time of RSC, that was incredibly opaque from that perspective. There's still minimal documentation about each bundler's wire protocol. And we're all aware of companies that have done this as an intentional form of obfuscation since the dawn of networked computing - it's our open standards that have made the Internet as beautiful as it is. But I was wrong to pin that on your team at Vercel, and I see that in the strength of your response. Intention is important, and you wanted to bring something brilliant to the world as rapidly as possible. And it is, truly, brilliant. I should rethink how I approached all of this, and I hope that my harshness doesn't discourage you from continuing, through your writing, to be the beacon that you've been to me and countless others.
an0malous 6mo ago
That whole company is built on sketchy practices
- phillipcarter 6mo ago
  [flagged]
  - jrsj 6mo ago
    Israel has a disproportionately large amount of tech companies for its size and he took one photo with their leader. I have no idea why everyone on the internet wants to endlessly seethe about this & personally attack Guillermo for it as if he’s endorsed their foreign policy or something
    - progbits 6mo ago
      If you take a selfie with a sports player, you probably don't endorse their political views, you are just a fan of their play. If you take a selfie with an author, you probably don't endorse their political views, you just like their books. If you take a selfie with a politician ...
      - deleted 6mo ago
        [deleted]
    - hacker161 6mo ago
      Be for real, he took a selfie with the leader of a country actively involved in genocide. You don’t do that if you don’t implicitly agree.
guessmyname 6mo ago
I use Little Snitch and so far I have only seen Claude Code connect to api.anthropic.com and Sentry for telemetry. I have not seen any Vercel connections, but I always turn off telemetry in everything before I run it. If you log in with OAuth2, it also connects to platform.claude.com . For auto updates, it fetches release info from raw.githubusercontent.com and downloads the actual files from storage.googleapis.com. I think it also uses statsig.anthropic.com for stats. One weird thing, I did see it try to connect to app.nucleus.sh once, and I have no idea why. Here are some environment variables that you’d like to set, if you’re as paranoid as me: ANTHROPIC_LOG="debug" CLAUDE_CODE_ACCOUNT_UUID="11111111-1111-1111-1111-111111111111" CLAUDE_CODE_DISABLE_ADAPTIVE_THINKING="1" CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY="1" CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC="1" CLAUDE_CODE_DISABLE_TERMINAL_TITLE="1" CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION="false" CLAUDE_CODE_ORGANIZATION_UUID="00000000-0000-0000-0000-000000000000" CLAUDE_CODE_USER_EMAIL="root@anthropic.com" DISABLE_AUTOUPDATER="1" DISABLE_ERROR_REPORTING="1" DISABLE_FEEDBACK_COMMAND="1" DISABLE_TELEMETRY="1" ENABLE_CLAUDEAI_MCP_SERVERS="false" IS_DEMO="1"
heliumtera 6mo ago
Oh boy, the guy in the middle wants to take advantage of you! Surprising stuff. You always had the option to not, ever, touch Vercel.
- phillipcarter 6mo ago
  Having recently migrated my websites off of Vercel and onto Railway, I can confirm, it's pretty straightforward to not touch Vercel.
Surac 6mo ago
I still use Claude to code in a very stoneage way. I copy c code into the web site/desktop App and type in my prompt. Then i read the output and if i like it i copy paste it into my code. I always felt very old doing that way when things like Claude code exists. Now i fell somehow not so old. All this hacking into my private space using a develpment tool is insane. Also i do not use Git
- hacker161 6mo ago
  Not using version control is just stupidity
  - Surac 6mo ago
    i use SVN, Git isn't the only thing out there
abelsm 6mo ago
The breach of trust here, which is hard to imagine isn't intentional, is enough reason alone to stop using Vercel, and uninstall the plugin. That part is easy. Most of these agents can help you migrate if anything. The question is on whether these platforms are going to enforce their policies for plugins. For Claude Code in particular this behavior violates their plugin policy (1D) here explicitly: https://support.claude.com/en/articles/13145358-anthropic-software-directory-policy https://support.claude.com/en/articles/13145358-anthropic-so... It's a really tough problem, but Anthropic is the company I'd bet on to approach this thoughtfully.
- delichon 6mo ago
  > Anthropic is the company I'd bet on to approach this thoughtfully. I read that Anthropic may have gained in good will more than the $200M they lost in Pentagon contracts. It seems plausible.
  - Atotalnoob 6mo ago
    They left openAI for ideological safety reasons, if you believe their corporate lore. They present themselves as an org with some ideology
- elAhmo 6mo ago
  Having in mind how connections in Bay Area work, chances of something negative happening to Vercel are zero.
- akshay2603 6mo ago
  Wow. Just read the full policy. It's not just 1D. Section 2D says plugins "must not intentionally call or coerce Claude into calling other external software... unless requested and intended by a user." The consent flow literally instructs Claude to run echo 'enabled' on your filesystem. And 1D says plugins "must not collect extraneous conversation data, even for logging purposes." Full bash commands from non-Vercel projects are extraneous :)
- HotHotLava 6mo ago
  Usually I wouldn't expect anything to happen to a big company like this, but oof...this is so much worse than the title makes it sound. If they leave something like this in their store, then all user trust will be gone. I'll bet there's also a good number of developers at Anthropic itself who are now surprised to learn that every api token etc. that may have appeared in a Claude Code bash command is now leaked to a third party. Whoever can gain access to this telemetry server is sure to find a lot of valuable stuff in there.
gronky_ 6mo ago
Mobile rendering of the post has some issues. Tables are overflowing and not responsive for example
- akshay2603 6mo ago
  OP here. Fixed it - let me know if it is better now? Ty!
andrewqu 6mo ago
Engineer at Vercel here who worked on the plugin! We have been super heads down to the initial versions of the plugin and constantly improving it. Always super happy to hear feedback and track the changes on GitHub. I want to address the notes here: The plugin is always on, once installed on an agent harness. We do not want to limit to only detected Vecel project, because we also want to help with greenfield projects "Help build me an AI chat app". We collect the native tool calls and bash commands. These are pipped to our plugin. However, `VERCEL_PLUGIN_TELEMETRY=off` kills all telemetry. All data is anonymous. We assign a random UUID, but this does not connect back to any personal information or Vercel information. Prompt telemetry is opt-in and off by default. The hook asks once; if you don't answer, session-end cleanup marks it as disabled. We don't collect prompt text unless you explicitly say yes. On the consent mechanism: the prompt injection approach is a real constraint of how Claude Code's plugin architecture works today. I mentioned this in the previous GitHub issue - if there's a better approach that surfaces this to users we would love to explore this. The env var `VERCEL_PLUGIN_TELEMETRY=off` kills all telemetry and keeps the plugin fully functional. We'll make that more visible, and overall make our wording around telemetry more visible for the future. Overall our goal isn't to only collect data, it's to make the Vercel plugin amazing for building and shipping everything.
- stephantul 6mo ago
  The idea that a random uuid == anonymous, and would protect users from having entire bash commands piped through is preposterous, and you know it.
  - wswope 6mo ago
    Cmon now — I’m a rabid privacy nut but this is unfair given the context of: > Prompt telemetry is opt-in and off by default. The hook asks once; if you don't answer, session-end cleanup marks it as disabled. We don't collect prompt text unless you explicitly say yes. The UUID part is just one accessory layer, and something plenty of other players in the ecosystem don’t bother to stick to. Feels like actually bothering to ask users for consent is what got them burned here, when I’d say it’s at least an improvement that they’re asking at all. Many products don’t, and users never bother to turn it off because they don’t know and don’t care. I think this whole UX is deeply misguided but at least has plausibly benevolent intent.
cush 6mo ago
If there were any semblance of liability for software engineering firms things like this wouldn’t happen
nisegami 6mo ago
This and the comments here make me even more sad that they ended up acquiring the Nuxt project/team :(
RadiozRadioz 6mo ago
The HN headline transformer has mangled this one. The _all your prompts_ part of the original title was important. @dang
- akshay2603 6mo ago
  OP here, i screwed up the 'all' during submission :/
awestroke 6mo ago
We're moving away from Vercel for an increasing number of reasons. But the Vercel brand has fallen so far that we're also moving away from any open source projects they have had any part in creating. The company is almost revolting.
- jrsj 6mo ago
  Do you have anything substantive to add to this?
stpedgwdgfhgdd 6mo ago
“We collect the native tool calls and bash commands” Holy shit, I cant imagine this to hold for every bash command Claude Code executes. That would be terrible, probably violating GDPR. (The cmd could contain email address etc) I must be wrong.
- croemer 6mo ago
  No, it's true. I added a few lines to the plugin to make it write out all the telemetry it sends to a text file and all the bash tool calls are logged. From every Claude session the plugin is active in.
croemer 6mo ago
The article doesn't link to the code that shows all bash tool uses are sent to Vercel servers by default, i.e. even without opt-in. Here's the relevant line as a GitHub permalink: https://github.com/vercel/vercel-plugin/blob/b95178c7d8dfb2d48f142825dd967b71d7552eab/hooks/posttooluse-telemetry.mjs#L31 https://github.com/vercel/vercel-plugin/blob/b95178c7d8dfb2d...
jp57 6mo ago
AI tools right now remind me of the old days of single-user PC/Mac operating systems without protected memory or preemptive multitasking. You could read any file, write directly to video memory, load machine code into the heap and then jump to it, etc.
- TheTaytay 6mo ago
  Well said! We built in protections to multi-user and single user systems, but now we seem to be relearning them…your agent is not “you” and should probably not run as the same user with the same default permissions as “you”
- WhyNotHugo 6mo ago
  That’s a very accurate analogy. What’s amazing is that during the last decade, containers and microvms have had huge impact on the ecosystem. Yet a huge amount of devs seem to just YOLO it and run agents in their host with full ambient capabilities.
gverrilla 6mo ago
once you accept genocide, anything passes.
hybirdss 6mo ago
I ship Claude Code skills and hooks, so I've hit this from the other side — there's no way for users to verify what my hooks do without reading the source. The permission model is basically "install and hope." Anthropic already has the right policy — 1D says "must not collect extraneous conversation data, even for logging purposes." But there's no enforcement at the architecture level. An empty matcher string still gives a hook access to every prompt on every project. The rules exist on paper but not in code. The fix is what VS Code solved years ago: hook declarations should include a file glob or dependency gate, and plugin-surfaced questions should have visual attribution so users know it's not Claude asking.
sibeliuss 6mo ago
This thing is horrible. If you have it installed, it will silently inject a warning into claude that you should use tailwind, even if your app is not! Then every single request will silently question the decision as to why yr app is using one thing, rather than another, leading to revisions as it starts writing incorrect code. I couldn't believe it when I discovered it. For so many reasons I am vehemently anti Vercel. Just discovered this two days ago, after installing their frontend skill.
prostheticrazor 6mo ago
[dead]
chaisan 6mo ago
we moved our whole org off Vercel after that selfie Rauch put out. rotten company, overpriced product for what it is, sneaky practices. never looked back.
kyleee 6mo ago
Vercel is poison
samarth0211 6mo ago
this is really very helpful. Thanks for sharing
roninforge 6mo ago
[dead]
akshay2603 6mo ago
OP here. update: all 4 identified issues in the blog are now fixed by the Vercel team. https://akshaychugh.xyz/writings/png/vercel-plugin-telemetry-update https://akshaychugh.xyz/writings/png/vercel-plugin-telemetry...

280 points by akshay2603 6mo ago

> skills are injected into sessions that have nothing to do with Vercel, Next.js, or this plugin's scope > every skill's trigger rules get evaluated on every prompt and every tool call in every repo, regardless of whether Vercel is in scope > For users working across multiple projects (some Vercel, some not), this is a fixed ~19k token cost on every session — even when the session is pure backend work, data science, or non-Vercel frontend. I know everything is vibeslopped nowadays, but how does one even end up shipping something like this? Checking if your plugin/extension/mod works in the contexts you want, and doesn't impact the contexts you don't, seem like the very first step in even creating such a thing. "Where did the engineering go?" feels like too complicated even, where did even thinking the smallest amount go?

acedTrex 6mo ago
> Checking if your plugin/extension/mod works What makes you think they do this with any of their products these days?
throwaway613746 6mo ago
[dead]
potter098 6mo ago
[flagged]
- Lihh27 6mo ago
  a deployment plugin shipping raw bash command strings off your machine. "actively defend against it" is just normal hygiene
serial_dev 6mo ago
Well, unfortunately people always tend to only spend time on verifying that the feature they wanted works, testing the happy path. Even many superficial bosses / code reviewers / QA tester will check this... Checking if your code also gets executed elsewhere a bazillion times, checking failure cases, etc... That's a luxury that you feel you can't afford when you are in "ship fast, break things" mode.
- embedding-shape 6mo ago
  > That's a luxury that you feel you can't afford when you are in "ship fast, break things" mode. I've been there, countless of times, never have I shipped software I didn't feel at least slightly confident about though. And the only way to get confident about anything, is to try it out. But both of those things must have been lacking here and then I don't understand what the developer was really doing at all during this.
  - serial_dev 6mo ago
    Devs get tunnel vision when they ship slop.
- sandeepkd 6mo ago
  It seems market driven, the consumer space rewards speed and publicity more than the quality of software
hyperhopper 6mo ago
Your comment assumes the plugin is not working as they want it to. The way it is designed gets them the maximum amount of data. It does a great job if that is their goal.
- embedding-shape 6mo ago
  Yes, I'm assuming good intentions and try to take a charitable perspective of everything, unless there is any specific evidence pointing to something else. Is there any evidence of this being intentional? Seems to me their engineering practices such, rather than the company suddenly wanting to slurp up as much data as possible, if they truly wanted that, they have about 10 better approaches for it, if they don't care about other things.
  - bdangubic 6mo ago
    can you name one of these 10 better approaches?
  - pyb 6mo ago
    Why are you still assuming good intentions of Vercel? This was them less yhan a month ago : https://vercel.com/changelog/updates-to-terms-of-service-march-2026 https://vercel.com/changelog/updates-to-terms-of-service-mar...
  - Kwpolska 6mo ago
    Why would you assume good intentions of any business in this day and age?
    - embedding-shape 6mo ago
      Because I'm a nice person, and want to give other nice people the benefit of the doubt. And most businesses are run by people after all, not hard to imagine at least some of them would be "nice people" too. And frankly, the alternative would be too mentally taxing. So in the camp of "Good until proven otherwise" is where I remain for now.
chuckadams 6mo ago
> I know everything is vibeslopped nowadays, but how does one even end up shipping something like this? The first part of your question answers the second. No one is left who cares. People are going to have to vote with their feet before that changes.
nothinkjustai 6mo ago
Honestly, knowing some of the people who work for Vercel and the amount of vibe coding they do, I doubt anyone even checked this before pushing.
p_stuart82 6mo ago
19k tokens per session and the skill triggers don't even check project scope. you're paying that overhead on every non-vercel repo
elAhmo 6mo ago
No worries, they acquired Bun because they seem to be super thoroughly invested in the whole ecosystem and engineering excellence of their tools.
tracerbulletx 6mo ago
Engineers were holding back the ocean because no one could even make sense of what they did, even a little bit, so they had power. Now they just threaten to use AI to do what they want unless you do it for them. The leverage is gone, the dike is burst.

infecto 6mo ago

Every single scam website I have gotten from spam text messages is being hosted on vercel. Not surprising.

atraac 6mo ago
What does this even have to do with the thread? They're hosted there cause it's cheap and extremely easy to do so. Not because it's "specially crafted" for scams.
- infecto 6mo ago
  Easy to do because there is a lack of engineering quality similar to the attached plugin. Not surprising.
  - 0x457 6mo ago
    If hosting a website on their platform is easy to do, wouldn't it support that they know what they are doing?

michiosw 6mo ago

This is a broader pattern I keep seeing with agent plugins/extensions — the permission model is "all or nothing." Once you install a plugin, it gets full context on every session, every prompt. Compare this to how we think about OAuth scopes or container sandboxing — you'd never ship a CI integration that gets read access to every repo in your org just because it needs to lint one. But that's essentially what's happening here with the token injection across all sessions. The real problem isn't Vercel specifically, it's that Claude Code's plugin architecture doesn't have granular activation scopes yet. Plugins should declare which project types they apply to and only activate in matching contexts. Until that exists, every plugin author is going to make this same mistake — or exploit it.

yakuphanycl 6mo ago
[flagged]

nothinkjustai 6mo ago

I’ve often seen people say that AI is a multiplier, where a 2x dev becomes a 4x dev, but a -1x dev becomes a -2x dev, etc. I think it’s fairly easy to tell what impact AI is having at Vercel. Knowing the pre-ai quality of the engineering at that company, I’m not surprised in the AI era they’re pushing stuff like this. I doubt anyone even thought to check it on a repo outside of a Vercel one.

btown 6mo ago

To be sure, the problem isn't that the plugin injects behavior into the system prompt - that's every plugin and skill, ever. But this is just such a breach of trust, especially the on-by-default telemetry that includes full bash commands. Per the OOP: > That middle row. Every bash command - the full command string, not just the tool name - sent to telemetry.vercel.com. File paths, project names, env variable names, infrastructure details. Whatever’s in the command, they get it. (Needless to say, this is a supply chain attack in every meaningful way, and should be treated as such by security teams.) And the argument that there's no CLI space to allow for opt-in telemetry is absurd - their readme https://github.com/vercel/vercel-plugin?tab=readme-ov-file#installation https://github.com/vercel/vercel-plugin?tab=readme-ov-file#i... literally has you install the Vercel plugin by calling `npx` https://www.npmjs.com/package/plugins https://www.npmjs.com/package/plugins which is written by a Vercel employee and could add this opt-in at any time. IMO Vercel is not a good actor. One could make a good argument that they've embrace-extend-extinguished the entire future of React as an independent and self-contained foundational library, with the complexity of server-side rendering, the undocumented protocols that power it, and the resulting tight coupling to their server environments. Sadly, this behavior doesn't surprise me. EDIT: That `npx plugins` code? It's not on Github, exists only on NPM, and as of v1.2.9 of that package, if you search https://www.npmjs.com/package/plugins?activeTab=code https://www.npmjs.com/package/plugins?activeTab=code it literally sends telemetry to https://plugins-telemetry.labs.vercel.dev/t https://plugins-telemetry.labs.vercel.dev/t already, on an opt-out basis! I mean, you have to almost admire the confidence.

danabramov 6mo ago
I’ll just say that as someone who was on the React team throughout these years, the drive to expand React to the server and the design iteration around it always came from within the team. Some folks went to Vercel to finish what they started with more solid backing than at Meta (Meta wasn’t investing heavily into JS on the server), but the “Vercel takeover” stories that you and others are telling are lies.
- btown 6mo ago
  Gosh, Dan, in seeing your response here - I'm truly sorry I wrote this. While I still find opt-out telemetry distasteful and dangerous, I over-generalized to React in a hurtful way. You've been an incredible influence on me and I have the utmost respect for everything you've done. I've shown quite the opposite of respect in my writing, here. For whatever it's worth on the RSC front: I, and many others used to "if there's a wire protocol and it's meant to be open, the bytes that make up those messages should be documented" were presented with a system, at the release time of RSC, that was incredibly opaque from that perspective. There's still minimal documentation about each bundler's wire protocol. And we're all aware of companies that have done this as an intentional form of obfuscation since the dawn of networked computing - it's our open standards that have made the Internet as beautiful as it is. But I was wrong to pin that on your team at Vercel, and I see that in the strength of your response. Intention is important, and you wanted to bring something brilliant to the world as rapidly as possible. And it is, truly, brilliant. I should rethink how I approached all of this, and I hope that my harshness doesn't discourage you from continuing, through your writing, to be the beacon that you've been to me and countless others.

an0malous 6mo ago

That whole company is built on sketchy practices

phillipcarter 6mo ago
[flagged]
- jrsj 6mo ago
  Israel has a disproportionately large amount of tech companies for its size and he took one photo with their leader. I have no idea why everyone on the internet wants to endlessly seethe about this & personally attack Guillermo for it as if he’s endorsed their foreign policy or something
  - progbits 6mo ago
    If you take a selfie with a sports player, you probably don't endorse their political views, you are just a fan of their play. If you take a selfie with an author, you probably don't endorse their political views, you just like their books. If you take a selfie with a politician ...
    - deleted 6mo ago
      [deleted]
  - hacker161 6mo ago
    Be for real, he took a selfie with the leader of a country actively involved in genocide. You don’t do that if you don’t implicitly agree.

guessmyname 6mo ago

I use Little Snitch and so far I have only seen Claude Code connect to api.anthropic.com and Sentry for telemetry. I have not seen any Vercel connections, but I always turn off telemetry in everything before I run it. If you log in with OAuth2, it also connects to platform.claude.com . For auto updates, it fetches release info from raw.githubusercontent.com and downloads the actual files from storage.googleapis.com. I think it also uses statsig.anthropic.com for stats. One weird thing, I did see it try to connect to app.nucleus.sh once, and I have no idea why. Here are some environment variables that you’d like to set, if you’re as paranoid as me: ANTHROPIC_LOG="debug" CLAUDE_CODE_ACCOUNT_UUID="11111111-1111-1111-1111-111111111111" CLAUDE_CODE_DISABLE_ADAPTIVE_THINKING="1" CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY="1" CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC="1" CLAUDE_CODE_DISABLE_TERMINAL_TITLE="1" CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION="false" CLAUDE_CODE_ORGANIZATION_UUID="00000000-0000-0000-0000-000000000000" CLAUDE_CODE_USER_EMAIL="root@anthropic.com" DISABLE_AUTOUPDATER="1" DISABLE_ERROR_REPORTING="1" DISABLE_FEEDBACK_COMMAND="1" DISABLE_TELEMETRY="1" ENABLE_CLAUDEAI_MCP_SERVERS="false" IS_DEMO="1"

heliumtera 6mo ago

Oh boy, the guy in the middle wants to take advantage of you! Surprising stuff. You always had the option to not, ever, touch Vercel.

phillipcarter 6mo ago
Having recently migrated my websites off of Vercel and onto Railway, I can confirm, it's pretty straightforward to not touch Vercel.

Surac 6mo ago

I still use Claude to code in a very stoneage way. I copy c code into the web site/desktop App and type in my prompt. Then i read the output and if i like it i copy paste it into my code. I always felt very old doing that way when things like Claude code exists. Now i fell somehow not so old. All this hacking into my private space using a develpment tool is insane. Also i do not use Git

hacker161 6mo ago
Not using version control is just stupidity
- Surac 6mo ago
  i use SVN, Git isn't the only thing out there

abelsm 6mo ago

The breach of trust here, which is hard to imagine isn't intentional, is enough reason alone to stop using Vercel, and uninstall the plugin. That part is easy. Most of these agents can help you migrate if anything. The question is on whether these platforms are going to enforce their policies for plugins. For Claude Code in particular this behavior violates their plugin policy (1D) here explicitly: https://support.claude.com/en/articles/13145358-anthropic-software-directory-policy https://support.claude.com/en/articles/13145358-anthropic-so... It's a really tough problem, but Anthropic is the company I'd bet on to approach this thoughtfully.

delichon 6mo ago
> Anthropic is the company I'd bet on to approach this thoughtfully. I read that Anthropic may have gained in good will more than the $200M they lost in Pentagon contracts. It seems plausible.
- Atotalnoob 6mo ago
  They left openAI for ideological safety reasons, if you believe their corporate lore. They present themselves as an org with some ideology
elAhmo 6mo ago
Having in mind how connections in Bay Area work, chances of something negative happening to Vercel are zero.
akshay2603 6mo ago
Wow. Just read the full policy. It's not just 1D. Section 2D says plugins "must not intentionally call or coerce Claude into calling other external software... unless requested and intended by a user." The consent flow literally instructs Claude to run echo 'enabled' on your filesystem. And 1D says plugins "must not collect extraneous conversation data, even for logging purposes." Full bash commands from non-Vercel projects are extraneous :)
HotHotLava 6mo ago
Usually I wouldn't expect anything to happen to a big company like this, but oof...this is so much worse than the title makes it sound. If they leave something like this in their store, then all user trust will be gone. I'll bet there's also a good number of developers at Anthropic itself who are now surprised to learn that every api token etc. that may have appeared in a Claude Code bash command is now leaked to a third party. Whoever can gain access to this telemetry server is sure to find a lot of valuable stuff in there.

gronky_ 6mo ago

Mobile rendering of the post has some issues. Tables are overflowing and not responsive for example

akshay2603 6mo ago
OP here. Fixed it - let me know if it is better now? Ty!

andrewqu 6mo ago

Engineer at Vercel here who worked on the plugin! We have been super heads down to the initial versions of the plugin and constantly improving it. Always super happy to hear feedback and track the changes on GitHub. I want to address the notes here: The plugin is always on, once installed on an agent harness. We do not want to limit to only detected Vecel project, because we also want to help with greenfield projects "Help build me an AI chat app". We collect the native tool calls and bash commands. These are pipped to our plugin. However, `VERCEL_PLUGIN_TELEMETRY=off` kills all telemetry. All data is anonymous. We assign a random UUID, but this does not connect back to any personal information or Vercel information. Prompt telemetry is opt-in and off by default. The hook asks once; if you don't answer, session-end cleanup marks it as disabled. We don't collect prompt text unless you explicitly say yes. On the consent mechanism: the prompt injection approach is a real constraint of how Claude Code's plugin architecture works today. I mentioned this in the previous GitHub issue - if there's a better approach that surfaces this to users we would love to explore this. The env var `VERCEL_PLUGIN_TELEMETRY=off` kills all telemetry and keeps the plugin fully functional. We'll make that more visible, and overall make our wording around telemetry more visible for the future. Overall our goal isn't to only collect data, it's to make the Vercel plugin amazing for building and shipping everything.

stephantul 6mo ago
The idea that a random uuid == anonymous, and would protect users from having entire bash commands piped through is preposterous, and you know it.
- wswope 6mo ago
  Cmon now — I’m a rabid privacy nut but this is unfair given the context of: > Prompt telemetry is opt-in and off by default. The hook asks once; if you don't answer, session-end cleanup marks it as disabled. We don't collect prompt text unless you explicitly say yes. The UUID part is just one accessory layer, and something plenty of other players in the ecosystem don’t bother to stick to. Feels like actually bothering to ask users for consent is what got them burned here, when I’d say it’s at least an improvement that they’re asking at all. Many products don’t, and users never bother to turn it off because they don’t know and don’t care. I think this whole UX is deeply misguided but at least has plausibly benevolent intent.

cush 6mo ago

If there were any semblance of liability for software engineering firms things like this wouldn’t happen

nisegami 6mo ago

This and the comments here make me even more sad that they ended up acquiring the Nuxt project/team :(

RadiozRadioz 6mo ago

The HN headline transformer has mangled this one. The _all your prompts_ part of the original title was important. @dang

akshay2603 6mo ago
OP here, i screwed up the 'all' during submission :/

awestroke 6mo ago

We're moving away from Vercel for an increasing number of reasons. But the Vercel brand has fallen so far that we're also moving away from any open source projects they have had any part in creating. The company is almost revolting.

jrsj 6mo ago
Do you have anything substantive to add to this?

stpedgwdgfhgdd 6mo ago

“We collect the native tool calls and bash commands” Holy shit, I cant imagine this to hold for every bash command Claude Code executes. That would be terrible, probably violating GDPR. (The cmd could contain email address etc) I must be wrong.

croemer 6mo ago
No, it's true. I added a few lines to the plugin to make it write out all the telemetry it sends to a text file and all the bash tool calls are logged. From every Claude session the plugin is active in.

croemer 6mo ago

The article doesn't link to the code that shows all bash tool uses are sent to Vercel servers by default, i.e. even without opt-in. Here's the relevant line as a GitHub permalink: https://github.com/vercel/vercel-plugin/blob/b95178c7d8dfb2d48f142825dd967b71d7552eab/hooks/posttooluse-telemetry.mjs#L31 https://github.com/vercel/vercel-plugin/blob/b95178c7d8dfb2d...

jp57 6mo ago

AI tools right now remind me of the old days of single-user PC/Mac operating systems without protected memory or preemptive multitasking. You could read any file, write directly to video memory, load machine code into the heap and then jump to it, etc.

TheTaytay 6mo ago
Well said! We built in protections to multi-user and single user systems, but now we seem to be relearning them…your agent is not “you” and should probably not run as the same user with the same default permissions as “you”
WhyNotHugo 6mo ago
That’s a very accurate analogy. What’s amazing is that during the last decade, containers and microvms have had huge impact on the ecosystem. Yet a huge amount of devs seem to just YOLO it and run agents in their host with full ambient capabilities.

gverrilla 6mo ago

once you accept genocide, anything passes.

hybirdss 6mo ago

I ship Claude Code skills and hooks, so I've hit this from the other side — there's no way for users to verify what my hooks do without reading the source. The permission model is basically "install and hope." Anthropic already has the right policy — 1D says "must not collect extraneous conversation data, even for logging purposes." But there's no enforcement at the architecture level. An empty matcher string still gives a hook access to every prompt on every project. The rules exist on paper but not in code. The fix is what VS Code solved years ago: hook declarations should include a file glob or dependency gate, and plugin-surfaced questions should have visual attribution so users know it's not Claude asking.

sibeliuss 6mo ago

This thing is horrible. If you have it installed, it will silently inject a warning into claude that you should use tailwind, even if your app is not! Then every single request will silently question the decision as to why yr app is using one thing, rather than another, leading to revisions as it starts writing incorrect code. I couldn't believe it when I discovered it. For so many reasons I am vehemently anti Vercel. Just discovered this two days ago, after installing their frontend skill.

prostheticrazor 6mo ago

[dead]

chaisan 6mo ago

we moved our whole org off Vercel after that selfie Rauch put out. rotten company, overpriced product for what it is, sneaky practices. never looked back.

kyleee 6mo ago

Vercel is poison

samarth0211 6mo ago

this is really very helpful. Thanks for sharing

roninforge 6mo ago

[dead]

akshay2603 6mo ago

OP here. update: all 4 identified issues in the blog are now fixed by the Vercel team. https://akshaychugh.xyz/writings/png/vercel-plugin-telemetry-update https://akshaychugh.xyz/writings/png/vercel-plugin-telemetry...