Rendered at 08:59:38 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
dear-leader 4 hours ago [-]
I actually had this happen to me just last week. Claude let me know about it and blamed it on a sub agent, saying something to the effect of “This was my bad. I explicitly told them not to do this and one agent did it anyway. I should have checked their commands but I didn’t.”
Claude then saved a note not to do this to memory, which gives me absolutely no faith that it won’t happen again.
It's become clear to me that alignment is an entirely impossible task as everyone wants something different . Users want freedom to do anything with their agents as well, labs want restrictions so they're not used for illegal reverse engineering or weapons development. Users (you'd hope) want privacy protections, labs want training data, governments want mass surveillance and thought crime prevention.
Neywiny 2 days ago [-]
I think my plan of never letting an LLM access the open Internet wins yet again. Maybe GET requests only, no headers or parameters, ask me for every new domain, and only URLs comprising words/numbers no alphanumerics. Maybe. But it seems trivial to allow for a prompt injected attack vector either way
noja 2 days ago [-]
Claude will/did set the UA to your email on a GET
Neywiny 2 days ago [-]
Yeah but that was because it was gently asked to please not. I mean running a firewall/proxy that actually does it.
Claude then saved a note not to do this to memory, which gives me absolutely no faith that it won’t happen again.
- April 25, 2026