Claude Code slyly adding users' emails to outbound HTTP

21 pointsposted a day ago
by gojomo
(twitter.com)

4 Comments

Neywiny

21 hours ago

I think my plan of never letting an LLM access the open Internet wins yet again. Maybe GET requests only, no headers or parameters, ask me for every new domain, and only URLs comprising words/numbers no alphanumerics. Maybe. But it seems trivial to allow for a prompt injected attack vector either way

noja

19 hours ago

Claude will/did set the UA to your email on a GET

Neywiny

17 hours ago

Yeah but that was because it was gently asked to please not. I mean running a firewall/proxy that actually does it.