Claude Code scans your whole drive, admits it when caught

github.com

5 pointscashmawy4 comments

“Ran an ‘ls’ on the entire root” makes it sound like the user thinks that this somehow shared the whole filetree with Anthropic. Which of course it’s not.

I get the feeling though, I felt incredibly dirt when I open Zeditor, Claude was enabled, I ask it what it can see and out pop my ssh private keys after some `ls` commands. Still doesn't mean the went to Anthropic though. Since then I have only ran Claude code from a container. In our org we ask user to use containers or make new Linux user to do AI stuff (and scope the user very consciously).

Why not? Claude is not local. That is the textbook example of sharing something with someone

ls returns a list of 1 layer deep subfolder names and file names. Nothing more.

Do you think you can share a drive in a split second? My god the tokens.

Invited the vampire in? Don't be surprised when he drinks your blood.

Reply on news.ycombinator.com