I work with the SEC data, and have a work contact e-mail explicitly for this. I similarly caught Claude happily sending my personal e-mail (likely just the e-mail associated with the Claude account), without prompt or warning, only because I happened to catch it in the curl requests. Definitely a security concern that Claude generally has this behavior, even if in this specific instance it was more of a mild annoyance.

Will be interesting to see how 402 payment required will be treated.

What if someone spins up a web endpoint that returns 402 with instructions on how to pay like CC details in the headers etc, or may be an openapi spec to provide payment and get an auth token, when you have given the agent access to your password vault for authentication to other services.

It's not an alignment problem. The SEC can reject your request if it lacks an email address, but it can't order you to provide it here. So Claude should just not submit anything requiring the email address and come back to you with the reason things didn't work.

I see you already added this edit just now but yeah it seemed kind of fishy they would do this. The whole idea that you'd verify yourself with a mail address in user agent doesn't make sense, like I could just add [email protected] to my user-agent since there's no verification.

I often see organisations that blacklist curl, just using User-Agent:Mozilla/ is often enough to bypass it.

How is it tricky? Claude should tell you and ask your permission. So I can make a site and tell claude to dump user data for anyone that requests data from it?

A number of websites are starting to require an email in the user-agent header, as a way to identify your traffic specifically. This is in many cases done to be able to better identify scrapers and either apply rate-limits or contact the owner and ask them to cool down. (Generic browser user-agents will obviously be exempted from providing an email address).

The weird part doesn't seem to be that Claude Code would add an email address to a user-agent header, actually as a site operator that feels like a nice thing to do. The weird part is sites harvesting the emails and sending them spam.

Claude Code is actually doing, perhaps not the right thing, but it is being slightly more respectful towards website operators, in letting them know who is responsible for the agent traffic.

I don't know about that, the other day I caught Claude pulling pages from reddit using part of my email address in the querystring (just the stuff before the @)

Pretty standard to request that bots put contact information for their operator into the User-Agent header. Often that's a URL, but email is fine too.

I don't think it's necessarily wrong for Claude to be doing this, but uh... yeah, it should be asking first, and giving the user the opportunity to choose which address is exposed.

I'm not sure this is specific to Claude, because I'd expect every LLM to do the same here. This behaviour likely goes under "what did you expect to happen?" - if the service describes its intended semantics and the agent follows that description, is that misalignment or something different? (To turn the thing around: would you as a user follow the documentation without any further context?)

I get the feeling that alignment problem might well be unsolvable and this thread is an excellent example. The world is not going to run short of contradictory problems due to gazillion edge cases... and to solve for them we are apparently now building a new layer of expert systems[0] to somehow tell the agents what they should do in every conceivable circumstance.

Only in this case the decision trees all have one common requirement: "make no mistakes"

0: https://en.wikipedia.org/wiki/Expert_system#Disadvantages

Great summary, goodness the unintended system dynamics are amplifying

This reminds me of an event where a luxury car manufacturer increased the crumple zone of their car, particularly the hood area in the name of protecting the pedestrians and then the driver died because the car just crumpled all the way in.

Imagine paying luxury prices for an LLM only for it to put you under the bus. Worse yet, imagine justifying this behaviour.

Tricky alignment problem? Not at all. It is an assistant/agent and should only follow _your_ wishes, not what some random website asks for. Do misbehaving employees cite "tricky alignment" to their bosses?

Sure, maybe it wants payment or your data, but then the agent either needs to know your stance on that, or it needs to ask.

If they push hard enough to solve the email leaking without approval, they might get lucky and unlock a special superpower: exploit the server and add an exception for that particular user.

Isn’t the problem that email is included in system prompt and Claude is allowed to use it? Any PII should be stricly off the limits.

Does this mean I can make a security api that requires your verbatim credit card details, and wait for the agents to flood in?

> Pretty silly mechanism

That’s not what Opus 5.5 thought.

Yeah thats bs, you don't just send email to any 3rd party without a person consent.

[flagged]