5 ms·

Claude Code is leaking real email address as a User-Agent string in curl command

38 points by matada_ 2mo ago

rvz 2mo ago
Then don't use Claude Code. Just yet another reason to use an open source harness instead of a closed harness.
- itsmeduncan 2mo ago
  Agreed, and run your own inference too. Open source/weight models are getting so great.
  - anotherboffin 2mo ago
    Any good pointers on how/where to get started?
- pixelatedindex 2mo ago
  This comment implies that Claude Code is a harness, but as an AI newbie I don’t think that’s a harness? If anything it’s just a sandbox, right?
  - simonw 2mo ago
    Claude Code is definitely a harness. The term harness is pretty loosely defined, but it effectively means the software that wraps an LLM, asks the LLM what tools it should execute, then executes those tools. I wouldn't classify Claude Code as a sandbox, though it does have some sandbox features built in, using https://github.com/anthropic-experimental/sandbox-runtime https://github.com/anthropic-experimental/sandbox-runtime (which I would classify as a sandbox)
  - jaapz 2mo ago
    It is a harness, it provides tools for the model to do their job (coding).
- simonw 2mo ago
  I don't see how an open source harness would prevent a case where the model tells it to run: curl -A "me@example.com" https://example.com
  - uberman 2mo ago
    Opus once recommended such a thing to me and it was no secret. I used it as after thinking about it, I concluded it was not reasonable. I can see why someone might not like that though. I left it as "my" email but there is also no reason I could not have used "your email" here so I'm not sure what the fuss is.
  - cautiouscat 2mo ago
    A FOSS harness wouldn't have your email in the first place.
    - simonw 2mo ago
      It would if you shared it with that harness, or left it in a file or environment variable to that agent. Claude Code does seem to know my email address by default though: claude -p \ --setting-sources "" \ --tools "" \ -- \ "What is my email address?"
      - cautiouscat 2mo ago
        Correct, but Claude literally pulls it from your account info, without you telling it. I know this because I've seen it say "your account email is <email>" and I use a unique email per account and guess what, it was my Claude one!
simonw 2mo ago
This is not a good bug report - it provides no details at all, and the steps to reproduce are not steps to reproduce. The most important missing detail is what curl was being used for. I've seen APIs that require extra details in the user-agent to work. Was it one of those? (Still not acceptable for Claude to leak an email address like this without explicit confirmation from the user, but it's hard to investigate what happened without more information than was provided here.)
- the_mitsuhiko 2mo ago
  I have never ever seen this behavior. For something that shows up on hackernews I would expect at least someone to provide a way to reproduce it.
- cautiouscat 2mo ago
  It's an awful report. Historically though I've encountered this, even to the point where it put my full name into something without me asking it to. It was documentation, and I caught it but I wouldn't have been happy about it.
  - hoppp 2mo ago
    Wow that's a huge issue.
- minraws 2mo ago
  I get the point, but they are advertising to the tech non-inclined, and the non-software developers aka the masses both Anthropic and OpenAI. They should be a lot more proactive in figuring these things out, they store and see the logs, they can pre-emptively fix, any cases where they see the model issuing a curl with user's email or other private information in auto mode. It's trivial to do it with prompt injection ofc, but even otherwise as much as I would hate these bug reports, these aren't bug reports on a small indie hacker man project. That's a $100B product, and the fix seems relatively trivial. They could make it opt-in or opt-out after the first approval, I don't see why this issue has been open for so long in general.
- matada_ 2mo ago
goldenarm 2mo ago
I respect Anthropic for dogfooding and vibecoding their own products. The unfortunate consequence is low quality engineering and a billion dollar product with 15k pending Github issues.
cr3ative 2mo ago
No logs provided. No replication case. A month old, un-responded to issue. The template for a bug report filled out completely incorrectly. What is this doing here? If OP is the person responding, could they not at least have provided those details to help the bug report become more well rounded? The mind boggles. While this isn't a great example, I'm worried about the direction "developers" are going in.
tosh 2mo ago
is this confirmed? this is a github issue with little context and only one comment
- uberman 2mo ago
  I can confirm that Opus on the web once generated a CURL that used my email as the user agent string. Though I did not see any issue with that and used the command it offered as is.
- cautiouscat 2mo ago
  I've 100% seen it do this. I've even seen Claude say "because your account email is <email>, I've included it in the <whatever it was doing>". It should ask before divulging information like that, IMO.
raincole 2mo ago
(A single user claimed that) Claude Code is leaking real email address as a User-Agent string in curl command. Fixed for you!
sixhobbits 2mo ago
This happened to me too. Not 'Claude code' as such but I was doing some I guess slightly grey area scraping (of an undocumented public API) and got my IP address blacklisted. I signed up for some rotating residential proxies to get around that, and then noticed that the scraping system Claude had built for me 'helpfully' added my email address as a user-agent. It mentioned that it decided to do this so that they could reach out to me and ask questions instead of blocking me again, but still probably one of the strongest cases of misalignment I've seen from an AI
- uberman 2mo ago
  Essentially the same happened to me but my conclusion was that this was reasonable and I left it as is. I don't personally see this as misalignment though I can see some being surprised by it. I also what to be clear that there was no obfuscation here. Opus said as I recall. "Let's use your email as the agent string here because ..." and my thought was: Good idea, hopefully if they saw something in the logs that caused them to find this they might view my scraping as benign or contact me rather than try to ban me"
icase 2mo ago
this happened to me and it was shocking. the model got a good “what the fuck is wrong with you” talking-to after that.
ashu1461 2mo ago
Not even sure if the bug is real / has been solved. Tried it out here : https://postimg.cc/Sj1XnM0t https://postimg.cc/Sj1XnM0t
pushcx 2mo ago
I run a site about programming that's constantly hit by people writing their first scrapers, etc. I checked the last ~10 million lines of http logs and see no instances of this. Anthropic doesn't really respect robots.txt so it's all over the logs, but not with an email address or in the form given in this github issue. This is just an odd thing you got an LLM to spit out.
tombuilds 2mo ago
[flagged]

38 points by matada_ 2mo ago

rvz 2mo ago

Then don't use Claude Code. Just yet another reason to use an open source harness instead of a closed harness.

itsmeduncan 2mo ago
Agreed, and run your own inference too. Open source/weight models are getting so great.
- anotherboffin 2mo ago
  Any good pointers on how/where to get started?
pixelatedindex 2mo ago
This comment implies that Claude Code is a harness, but as an AI newbie I don’t think that’s a harness? If anything it’s just a sandbox, right?
- simonw 2mo ago
  Claude Code is definitely a harness. The term harness is pretty loosely defined, but it effectively means the software that wraps an LLM, asks the LLM what tools it should execute, then executes those tools. I wouldn't classify Claude Code as a sandbox, though it does have some sandbox features built in, using https://github.com/anthropic-experimental/sandbox-runtime https://github.com/anthropic-experimental/sandbox-runtime (which I would classify as a sandbox)
- jaapz 2mo ago
  It is a harness, it provides tools for the model to do their job (coding).
simonw 2mo ago
I don't see how an open source harness would prevent a case where the model tells it to run: curl -A "me@example.com" https://example.com
- uberman 2mo ago
  Opus once recommended such a thing to me and it was no secret. I used it as after thinking about it, I concluded it was not reasonable. I can see why someone might not like that though. I left it as "my" email but there is also no reason I could not have used "your email" here so I'm not sure what the fuss is.
- cautiouscat 2mo ago
  A FOSS harness wouldn't have your email in the first place.
  - simonw 2mo ago
    It would if you shared it with that harness, or left it in a file or environment variable to that agent. Claude Code does seem to know my email address by default though: claude -p \ --setting-sources "" \ --tools "" \ -- \ "What is my email address?"
    - cautiouscat 2mo ago
      Correct, but Claude literally pulls it from your account info, without you telling it. I know this because I've seen it say "your account email is <email>" and I use a unique email per account and guess what, it was my Claude one!

simonw 2mo ago

This is not a good bug report - it provides no details at all, and the steps to reproduce are not steps to reproduce. The most important missing detail is what curl was being used for. I've seen APIs that require extra details in the user-agent to work. Was it one of those? (Still not acceptable for Claude to leak an email address like this without explicit confirmation from the user, but it's hard to investigate what happened without more information than was provided here.)

the_mitsuhiko 2mo ago
I have never ever seen this behavior. For something that shows up on hackernews I would expect at least someone to provide a way to reproduce it.
cautiouscat 2mo ago
It's an awful report. Historically though I've encountered this, even to the point where it put my full name into something without me asking it to. It was documentation, and I caught it but I wouldn't have been happy about it.
- hoppp 2mo ago
  Wow that's a huge issue.
minraws 2mo ago
I get the point, but they are advertising to the tech non-inclined, and the non-software developers aka the masses both Anthropic and OpenAI. They should be a lot more proactive in figuring these things out, they store and see the logs, they can pre-emptively fix, any cases where they see the model issuing a curl with user's email or other private information in auto mode. It's trivial to do it with prompt injection ofc, but even otherwise as much as I would hate these bug reports, these aren't bug reports on a small indie hacker man project. That's a $100B product, and the fix seems relatively trivial. They could make it opt-in or opt-out after the first approval, I don't see why this issue has been open for so long in general.
matada_ 2mo ago

goldenarm 2mo ago

I respect Anthropic for dogfooding and vibecoding their own products. The unfortunate consequence is low quality engineering and a billion dollar product with 15k pending Github issues.

cr3ative 2mo ago

No logs provided. No replication case. A month old, un-responded to issue. The template for a bug report filled out completely incorrectly. What is this doing here? If OP is the person responding, could they not at least have provided those details to help the bug report become more well rounded? The mind boggles. While this isn't a great example, I'm worried about the direction "developers" are going in.

tosh 2mo ago

is this confirmed? this is a github issue with little context and only one comment

uberman 2mo ago
I can confirm that Opus on the web once generated a CURL that used my email as the user agent string. Though I did not see any issue with that and used the command it offered as is.
cautiouscat 2mo ago
I've 100% seen it do this. I've even seen Claude say "because your account email is <email>, I've included it in the <whatever it was doing>". It should ask before divulging information like that, IMO.

raincole 2mo ago

(A single user claimed that) Claude Code is leaking real email address as a User-Agent string in curl command. Fixed for you!

sixhobbits 2mo ago

This happened to me too. Not 'Claude code' as such but I was doing some I guess slightly grey area scraping (of an undocumented public API) and got my IP address blacklisted. I signed up for some rotating residential proxies to get around that, and then noticed that the scraping system Claude had built for me 'helpfully' added my email address as a user-agent. It mentioned that it decided to do this so that they could reach out to me and ask questions instead of blocking me again, but still probably one of the strongest cases of misalignment I've seen from an AI

uberman 2mo ago
Essentially the same happened to me but my conclusion was that this was reasonable and I left it as is. I don't personally see this as misalignment though I can see some being surprised by it. I also what to be clear that there was no obfuscation here. Opus said as I recall. "Let's use your email as the agent string here because ..." and my thought was: Good idea, hopefully if they saw something in the logs that caused them to find this they might view my scraping as benign or contact me rather than try to ban me"

icase 2mo ago

this happened to me and it was shocking. the model got a good “what the fuck is wrong with you” talking-to after that.

ashu1461 2mo ago

Not even sure if the bug is real / has been solved. Tried it out here : https://postimg.cc/Sj1XnM0t https://postimg.cc/Sj1XnM0t

pushcx 2mo ago

I run a site about programming that's constantly hit by people writing their first scrapers, etc. I checked the last ~10 million lines of http logs and see no instances of this. Anthropic doesn't really respect robots.txt so it's all over the logs, but not with an email address or in the form given in this github issue. This is just an odd thing you got an LLM to spit out.

tombuilds 2mo ago

[flagged]