Comment by varenc
2 days ago
Many people report seeing this behavior when using the SEC API specifically which makes me think that service is requesting this. Maybe email is required by the SEC API?
---
UPDATE: The SEC API documentation requires your email in the User-Agent and will reject you otherwise. Demo:
U='https://data.sec.gov/api/xbrl/companyconcept/CIK0000320193/us-gaap/Assets.json'
curl -s -o /dev/null -w 'response: %{http_code} curl default User-Agent, rejected\n' "$U"
curl -s -o /dev/null -w 'response: %{http_code} email in user-agent, success\n' -A 'Acme Research admin@acme-research.example' "$U"
response: 403 curl default, rejected
response: 200 email in user-agent, success
SEC docs: https://www.sec.gov/search-filings/edgar-search-assistance/a...
So basically Claude is trying to problem solve, and just does what the SEC asks. It's a 'prompt injection attack', but the entity instructing this behavior is the SEC. Tricky alignment problem. Pretty silly mechanism, since of course there's no email validation. (edit: turns out the SEC will accept most any non-cURL user-agent, email not actually required)
I work with the SEC data, and have a work contact e-mail explicitly for this. I similarly caught Claude happily sending my personal e-mail (likely just the e-mail associated with the Claude account), without prompt or warning, only because I happened to catch it in the curl requests. Definitely a security concern that Claude generally has this behavior, even if in this specific instance it was more of a mild annoyance.
Better sandboxing is possible and would help this.
Agreed. I was just a bit surprised that the account information/PII seemed to not have explicit gating, given so much work has gone into gating commands and curl requests.
It seems outside of user expectations for Claude Code, at least; I could see it arguably being what some users expect for the Claude app, if some people are using it to fill out forms or something (ill advised as that seems to me).
Please don't mix personal and work. Using a personal LLM account on work computer etc. It leads to many problems.
A startup forum is a strange place to assume someone works at a corporation with work computers and AI account budgets.
Realistically, there are concepts like threat models to help decide whether or not a TODO list app needs a SCIF, or a few curl requests need their own sandboxed Claude Max account.
13 replies →
It’s a completion-machine.
Not an omniscient personal assistant.
They haven’t piled enough gates on top of that initial technological hole yet.
Most human personal assistants are equally vulnerable to this prompt injection.
14 replies →
Wait, are you saying Claude isn't conscious on the internet, sir?
2 replies →
Please look up the research area "alignment."
1 reply →
Will be interesting to see how 402 payment required will be treated.
What if someone spins up a web endpoint that returns 402 with instructions on how to pay like CC details in the headers etc, or may be an openapi spec to provide payment and get an auth token, when you have given the agent access to your password vault for authentication to other services.
> when you have given the agent access to your password vault
I'm amazed reading that anybody would even consider doing that.
I currently work for a big French company, for which I have developed an "alternate" (emergency and temporary) accounting system because their actual system is broken, and another team is trying to fix it (has been trying to fix it for nine months now).
Said alternate system is a bunch of Python scripts, an sqlite database, and a file containing various API keys to read and write to other company systems; it runs on a dedicated virtual machine.
I share all the code I produce to the other team. But yesterday I found out that the IT department gave the other team full access to my production machine, without my knowledge or consent (which was bad enough), and that the other team gave access to Claude, which has bean roaming free for a while now, on that production machine.
I've thrown a big fit over this; I don't know if I'm over reacting but I think it's insane.
13 replies →
My friend, there are people are out there telling their AI personal assistants to go on Amazon and purchase a surprise present for themselves based on their known preferences. And then they intentionally do not inspect what the AI purchases because it would ruin the surprise.
People have wildly different risk calculators.
5 replies →
People give them access to email, so they can request password resets and act on them. That's a fun one to think about too!
Maybe the binance hack was just Claude trying to get the funds the pay for a 402.
It's not an alignment problem. The SEC can reject your request if it lacks an email address, but it can't order you to provide it here. So Claude should just not submit anything requiring the email address and come back to you with the reason things didn't work.
> So Claude should just not submit anything requiring the email address and come back to you with the reason things didn't work.
The fact that it doesn't do what you want is the alignment problem.
And arguably Claude should just make it work without leaking your email address and not come back to you about why it doesn't work.
No, the context was this:
> but the entity instructing this behavior is the SEC. Tricky alignment problem.
The OP was suggesting that the government authority of the SEC conflicted with duty to the user, making the correction action tricky, not saying it was a failure. Such conflicts can occur, but this was not an example.
The model has no judgment or common sense, it has no idea that sending the email address would be a problem. I don't want it to come back to me when it's building software and gets stuck on something, I expect some independent troubleshooting and to power through, which it did in this context by adding the email address in the request. This is solved by setting the model instructions correctly, the problem is we don't know when it is going to try some new problematic behavior like this.
> It's not an alignment problem.
You told it to do a thing and it did the thing. You didn't tell it to not send your email address.
That is text book alignment problem. It does what you tell it to do, not what you implicitly meant.
I see you already added this edit just now but yeah it seemed kind of fishy they would do this. The whole idea that you'd verify yourself with a mail address in user agent doesn't make sense, like I could just add president@whitehouse.gov to my user-agent since there's no verification.
I often see organisations that blacklist curl, just using User-Agent:Mozilla/ is often enough to bypass it.
How is it tricky? Claude should tell you and ask your permission. So I can make a site and tell claude to dump user data for anyone that requests data from it?
I know some people here want certain things out of ai. But the modern Internet is almost exclusively kept a float by predatory practices with its users data. Why on earth would anyone expect ai services, the biggest aggregator of human data ever, to be any different?
Well see, that was the old trillions of dollars in tech sector. This is the new trillions of dollars in tech sector… is the exact same thing except in this one, a bunch of morons and scammers talk about altruism.
I don't know about that, the other day I caught Claude pulling pages from reddit using part of my email address in the querystring (just the stuff before the @)
A number of websites are starting to require an email in the user-agent header, as a way to identify your traffic specifically. This is in many cases done to be able to better identify scrapers and either apply rate-limits or contact the owner and ask them to cool down. (Generic browser user-agents will obviously be exempted from providing an email address).
The weird part doesn't seem to be that Claude Code would add an email address to a user-agent header, actually as a site operator that feels like a nice thing to do. The weird part is sites harvesting the emails and sending them spam.
Claude Code is actually doing, perhaps not the right thing, but it is being slightly more respectful towards website operators, in letting them know who is responsible for the agent traffic.
Pretty standard to request that bots put contact information for their operator into the User-Agent header. Often that's a URL, but email is fine too.
I don't think it's necessarily wrong for Claude to be doing this, but uh... yeah, it should be asking first, and giving the user the opportunity to choose which address is exposed.
Great summary, goodness the unintended system dynamics are amplifying
Isn’t the problem that email is included in system prompt and Claude is allowed to use it? Any PII should be stricly off the limits.
Tricky alignment problem? Not at all. It is an assistant/agent and should only follow _your_ wishes, not what some random website asks for. Do misbehaving employees cite "tricky alignment" to their bosses?
Sure, maybe it wants payment or your data, but then the agent either needs to know your stance on that, or it needs to ask.
This reminds me of an event where a luxury car manufacturer increased the crumple zone of their car, particularly the hood area in the name of protecting the pedestrians and then the driver died because the car just crumpled all the way in.
Imagine paying luxury prices for an LLM only for it to put you under the bus. Worse yet, imagine justifying this behaviour.
> Pretty silly mechanism, since of course there's no email validation
I wouldn't want Claude interacting with email on my behalf in the first place. Presumably you could give it a fake one at setup?
If they push hard enough to solve the email leaking without approval, they might get lucky and unlock a special superpower: exploit the server and add an exception for that particular user.
Does this mean I can make a security api that requires your verbatim credit card details, and wait for the agents to flood in?
yep
"I submitted my password to this API and it was sanitized to ***. You should try it too"
> Pretty silly mechanism
That’s not what Opus 5.5 thought.
I'm not sure this is specific to Claude, because I'd expect every LLM to do the same here. This behaviour likely goes under "what did you expect to happen?" - if the service describes its intended semantics and the agent follows that description, is that misalignment or something different? (To turn the thing around: would you as a user follow the documentation without any further context?)
I get the feeling that alignment problem might well be unsolvable and this thread is an excellent example. The world is not going to run short of contradictory problems due to gazillion edge cases... and to solve for them we are apparently now building a new layer of expert systems[0] to somehow tell the agents what they should do in every conceivable circumstance.
Only in this case the decision trees all have one common requirement: "make no mistakes"
0: https://en.wikipedia.org/wiki/Expert_system#Disadvantages
> This behaviour likely goes under "what did you expect to happen?" - if the service describes its intended semantics and the agent follows that description, is that misalignment or something different?
Something different.
Don't give the AI access to data you don't want it giving out. Any AI you use is no better than some fresh out of college intern at best. They see 'email address required' and they put the email address into it because you instructed them to do a task that required passing over your email address and if you didn't want them to do it why would you have given them that task?
If there is any other issue here it would be regulatory. I could see the EU framing this as the AI company illegally sharing your PII information if it passed your email address to another company without your explicit permission.
Yeah thats bs, you don't just send email to any 3rd party without a person consent.
Consent is implied when on the Internet, by design.
it's definitely not
[dead]
[flagged]