Comment by T-R
1 day ago
I work with the SEC data, and have a work contact e-mail explicitly for this. I similarly caught Claude happily sending my personal e-mail (likely just the e-mail associated with the Claude account), without prompt or warning, only because I happened to catch it in the curl requests. Definitely a security concern that Claude generally has this behavior, even if in this specific instance it was more of a mild annoyance.
Better sandboxing is possible and would help this.
Agreed. I was just a bit surprised that the account information/PII seemed to not have explicit gating, given so much work has gone into gating commands and curl requests.
It seems outside of user expectations for Claude Code, at least; I could see it arguably being what some users expect for the Claude app, if some people are using it to fill out forms or something (ill advised as that seems to me).
Please don't mix personal and work. Using a personal LLM account on work computer etc. It leads to many problems.
A startup forum is a strange place to assume someone works at a corporation with work computers and AI account budgets.
Realistically, there are concepts like threat models to help decide whether or not a TODO list app needs a SCIF, or a few curl requests need their own sandboxed Claude Max account.
Even if you have to use personal laptops for work, why wouldn't you create separate users for work and personal lives?
It's insane to me that programmers out of all people seem utterly incapable of accepting the most minor of inconvenience for the most modest modicum of privacy and security. There are other people in this post complaining that Claude should have asked the user before sending network requests. Well guess what, it does if you don't fucking run `--dangerously-skip-permissions`, but you do because how else you are gonna slop your way to rewrite every swath of existing insecure software to fix the bullshits this industry impounded upon itself unconscientiously for the past 30 years by allowing a non-deterministic babeller RCE its way onto your fucking personal-work machine.
10 replies →
It is well known that the readers of this forum are not limited to start ups. There are plenty of people that work for well established companies. Also, it is never a bad idea to remind people to keep personal/work data separate by never using employer provided equipment for personal use of any sort. See, I just did it again.
Also, just because this is a "start up forum" does not mean all of the readers are founders running a start up. Many are just people working at a start up. Sounds like yet another example of someone so scoped in, that the assumption is that everyone is the same losing site that there are lots of readers that at the end of the day are just worker bees even if they are more technically minded
1 reply →
It’s a completion-machine.
Not an omniscient personal assistant.
They haven’t piled enough gates on top of that initial technological hole yet.
Most human personal assistants are equally vulnerable to this prompt injection.
Yeah, anyone who has had to manage developers in a big company will be able to tell you that it is a constant struggle between giving them freedom to work independently and get things done vs. limiting their access to prevent potential bad stuff from happening. In practice, the more bad stuff happens (and the more consultants you allow in), the more hurdles are introduced. Eventually even trivial tasks become a corporate nightmare of approvals. You can't have the conveniences of both work philosophies at the same time. Even the smartest AI agents won't change that fact. It simply limits their work speed to the speed of the approval process.
4 replies →
They actually aren't. There is ambiguity on what the proper email to use is.
I have, never in my career, had any of my coworkers deanonymize my browsing or leak my email address everywhere on the internet. Your copy-pasted, thought-terminating argument doesn't work here.
6 replies →
Most human personal assistants don't have access to vast swathes of private data that they collected without permission, unless your house is the site of multiple watergates
Wait, are you saying Claude isn't conscious on the internet, sir?
You're dehumanizing Claude, sir. That's against Anthropic's updated ToS!
Say more, or say less.
Please look up the research area "alignment."
You can align until the Sun goes out,
the base technology sees all context as equal to user instruction if the context has enough weight.