Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

alex000kim.com

Post reply on HN
Print view View original

141–150 of 636 posts

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#141

Post by sixtyj »

mzajc wrote: post #37

There are now several comments that (incorrectly?) interpret the undercover mode as only hiding internal information. Excerpts from the actual prompt[0]: NEVER include in commit messages or PR descriptions: - The phrase "Claude Code" or any mention that you are an AI - Co-Authored-By lines or any other attribution BAD (never write these): - 1-shotted by claude-opus-4-6 - Generated with Claude Code - Co-Authored-By: C…

People make fun that we should say magic words in interaction with LLMs. How frustrated can Claude be? /s

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#142

Post by [deleted] »

ImPostingOnHN wrote: post #82
fweimer wrote: post #72

Earlier quoted context omitted.

The commit message should complement the code. Ideally, what the code does should not need a separate description, but of course there can be exceptions. Usually, it's more interesting to capture in the commit message what is not in the code: the reason why this approach was chosen and not some other obvious one. Or describe what is missing, and why it isn't needed.

That sounds like design discussions best had in the issue/ticket itself, before you even start writing code. Then the commit message references the ticket and has a brief summary of the changes. Writing and reading paragraphs of design discussion in a commit message is not something that seems common.

[deleted]

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#143

Post by fweimer »

ImPostingOnHN wrote: post #82
fweimer wrote: post #72

Earlier quoted context omitted.

The commit message should complement the code. Ideally, what the code does should not need a separate description, but of course there can be exceptions. Usually, it's more interesting to capture in the commit message what is not in the code: the reason why this approach was chosen and not some other obvious one. Or describe what is missing, and why it isn't needed.

That sounds like design discussions best had in the issue/ticket itself, before you even start writing code. Then the commit message references the ticket and has a brief summary of the changes. Writing and reading paragraphs of design discussion in a commit message is not something that seems common.

Ticket systems are quite ephemeral. I still have access to commit messages from the 90s (and I didn't work on the software at the time). I haven't been able to track the contents of the gnats bug tracker from those days.

And of course tickets can be private, so even if the data survived migration, you may not have access to it (principle of least privilege and all that).

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#144

Post by Stromgren »

petcat wrote: post #46
mzajc wrote: post #37

There are now several comments that (incorrectly?) interpret the undercover mode as only hiding internal information. Excerpts from the actual prompt[0]: NEVER include in commit messages or PR descriptions: - The phrase "Claude Code" or any mention that you are an AI - Co-Authored-By lines or any other attribution BAD (never write these): - 1-shotted by claude-opus-4-6 - Generated with Claude Code - Co-Authored-By: C…

It's less about pretending to be a human and more about not inviting scrutiny and ridicule toward Claude if the code quality is bad. They want the real human to appear to be responsible for accepting Claud's poor output.

That’s how I’d want it to be honestly. LLMs are tools and I’d hope we’re going to keep the people using them responsible. Just like any other tools we use.

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#145

Post by yalok »

causal wrote: post #28

I'm amazed at how much of what my past employers would call trade secrets are just being shipped in the source. Including comments that just plainly state the whole business backstory of certain decisions. It's like they discarded all release harnesses and project tracking and just YOLO'd everything into the codebase itself. Edit: Everyone is responding "comments are good" and I can't tell if any of you actually read…

vibe-coded all the way through

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#146

Post by dgunay »

perching_aix wrote: post #60
CharlieDigital wrote: post #38

Earlier quoted context omitted.

Comments are the ultimate agent coding hack. If you're not using comments, you're doing agent coding wrong. Why? Agents may or may not read docs. It may or may not use skills or tools. It will always read comments "in the line of sight" of the task. You get free long term agent memory with zero infrastructure.

Agents and I apparently have a whole lot in common. Only being half ironic with this. I generally find that people somehow magically manage to understand how to be materially helpful when the subject is a helpless LLM. Instead of pointing it to a random KB page, they give it context. They then shorten that context. They then interleave context as comments. They provide relevant details. They go out of their way to co…

Right? It's infuriating. Nearly all of the agentic coding best practices are things that we should have just been doing all along, because it turns out humans function better too when given the proper context for their work. The only silver lining is that this is a colossal karmic retribution for the orgs that never gave a shit about this stuff until LLMs.

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#148

Post by chuckadams »

pixl97 wrote: post #2

>Claude Code also uses Axios for HTTP. Interesting based on the other news that is out.

The exploit is a postinstall hook, so CC users would be unaffected. Claude Code itself is most likely built with bun and not npm, so the CC developers would also be immune.

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#149

Post by wg0 »

I have yet to see such a company that's so insecure that they would keep their CLI closed source even when the secret sauce is in the model that they control already and is closed source.

Not only that, wouldn't allow other CLIs to be used either.

Post reply on HN