4 ms·

This is not a good bug report - it provides no details at all, and the steps to reproduce are not steps to reproduce. The most important missing detail is what

by simonw 2mo ago

This is not a good bug report - it provides no details at all, and the steps to reproduce are not steps to reproduce. The most important missing detail is what curl was being used for. I've seen APIs that require extra details in the user-agent to work. Was it one of those? (Still not acceptable for Claude to leak an email address like this without explicit confirmation from the user, but it's hard to investigate what happened without more information than was provided here.)

the_mitsuhiko 2mo ago
I have never ever seen this behavior. For something that shows up on hackernews I would expect at least someone to provide a way to reproduce it.
cautiouscat 2mo ago
It's an awful report. Historically though I've encountered this, even to the point where it put my full name into something without me asking it to. It was documentation, and I caught it but I wouldn't have been happy about it.
- hoppp 2mo ago
  Wow that's a huge issue.
minraws 2mo ago
I get the point, but they are advertising to the tech non-inclined, and the non-software developers aka the masses both Anthropic and OpenAI. They should be a lot more proactive in figuring these things out, they store and see the logs, they can pre-emptively fix, any cases where they see the model issuing a curl with user's email or other private information in auto mode. It's trivial to do it with prompt injection ofc, but even otherwise as much as I would hate these bug reports, these aren't bug reports on a small indie hacker man project. That's a $100B product, and the fix seems relatively trivial. They could make it opt-in or opt-out after the first approval, I don't see why this issue has been open for so long in general.
matada_ 2mo ago
fair point, I'm not the author. I updated my comment with more info https://github.com/anthropics/claude-code/issues/78431#issuecomment-5254217308 https://github.com/anthropics/claude-code/issues/78431#issue...
reycharles 2mo ago
To be fair, the bug report is against a type of software that is famously stochastic and unreproducible.

by simonw 2mo ago

the_mitsuhiko 2mo ago

I have never ever seen this behavior. For something that shows up on hackernews I would expect at least someone to provide a way to reproduce it.

cautiouscat 2mo ago

It's an awful report. Historically though I've encountered this, even to the point where it put my full name into something without me asking it to. It was documentation, and I caught it but I wouldn't have been happy about it.

hoppp 2mo ago
Wow that's a huge issue.

minraws 2mo ago

I get the point, but they are advertising to the tech non-inclined, and the non-software developers aka the masses both Anthropic and OpenAI. They should be a lot more proactive in figuring these things out, they store and see the logs, they can pre-emptively fix, any cases where they see the model issuing a curl with user's email or other private information in auto mode. It's trivial to do it with prompt injection ofc, but even otherwise as much as I would hate these bug reports, these aren't bug reports on a small indie hacker man project. That's a $100B product, and the fix seems relatively trivial. They could make it opt-in or opt-out after the first approval, I don't see why this issue has been open for so long in general.

matada_ 2mo ago

fair point, I'm not the author. I updated my comment with more info https://github.com/anthropics/claude-code/issues/78431#issuecomment-5254217308 https://github.com/anthropics/claude-code/issues/78431#issue...

reycharles 2mo ago

To be fair, the bug report is against a type of software that is famously stochastic and unreproducible.