Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

alex000kim.com

Post reply on HN
Print view View original

231–240 of 636 posts

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#231

Post by saghm »

perching_aix wrote: post #60
CharlieDigital wrote: post #38

Earlier quoted context omitted.

Comments are the ultimate agent coding hack. If you're not using comments, you're doing agent coding wrong. Why? Agents may or may not read docs. It may or may not use skills or tools. It will always read comments "in the line of sight" of the task. You get free long term agent memory with zero infrastructure.

Agents and I apparently have a whole lot in common. Only being half ironic with this. I generally find that people somehow magically manage to understand how to be materially helpful when the subject is a helpless LLM. Instead of pointing it to a random KB page, they give it context. They then shorten that context. They then interleave context as comments. They provide relevant details. They go out of their way to co…

> Only being half ironic with this. I generally find that people somehow magically manage to understand how to be materially helpful when the subject is a helpless LLM. Instead of pointing it to a random KB page, they give it context. They then shorten that context. They then interleave context as comments. They provide relevant details. They go out of their way to collect relevant details. Things they somehow don't do for their actual colleagues.

"Self-descriptive code doesn't need comments!" always gets an eye-roll from me

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#232

Post by noosphr »

saghm wrote: post #228
causal wrote: post #28

I'm amazed at how much of what my past employers would call trade secrets are just being shipped in the source. Including comments that just plainly state the whole business backstory of certain decisions. It's like they discarded all release harnesses and project tracking and just YOLO'd everything into the codebase itself. Edit: Everyone is responding "comments are good" and I can't tell if any of you actually read…

> just YOLO'd everything into the codebase itself I suspect that's the logical endpoint of trying to provide everything as context to an agent. Why use a separate markdown file and have to waste extra tokens explaining what part of the codebase something applies to when you can just put it right there in the code itself?

The issues is that you should have a work flow that strips the comments before sending the code to production. I'm sure they assumed that minifying it is enough though.

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#233

Post by thunky »

dgunay wrote: post #146
perching_aix wrote: post #60

Earlier quoted context omitted.

Agents and I apparently have a whole lot in common. Only being half ironic with this. I generally find that people somehow magically manage to understand how to be materially helpful when the subject is a helpless LLM. Instead of pointing it to a random KB page, they give it context. They then shorten that context. They then interleave context as comments. They provide relevant details. They go out of their way to co…

Right? It's infuriating. Nearly all of the agentic coding best practices are things that we should have just been doing all along, because it turns out humans function better too when given the proper context for their work. The only silver lining is that this is a colossal karmic retribution for the orgs that never gave a shit about this stuff until LLMs.

> It's infuriating. Nearly all of the agentic coding best practices are things that we should have just been doing all along

There's a good reason why we didn't though: because we didn't see any obvious value in it. So it felt like a waste of time. Now it feels like time well spent.

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#234

Post by saxelsen »

noman-land wrote: post #207
CharlieDigital wrote: post #38

Earlier quoted context omitted.

Comments are the ultimate agent coding hack. If you're not using comments, you're doing agent coding wrong. Why? Agents may or may not read docs. It may or may not use skills or tools. It will always read comments "in the line of sight" of the task. You get free long term agent memory with zero infrastructure.

This isn't just great advice ⸻ it's terrific advice. I'd love to delve a little deeper.

Would you like me to draft a list of recommendations for how best to use comments?

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#235

Post by graemep »

Sharlin wrote: post #215
graemep wrote: post #204

Earlier quoted context omitted.

Where is there any legal precedent for that? In some jurisdictions (e.g. the UK) the law is already clear that you own the copyright. In the US it is almost certain that you will be the author. The reports of cases saying otherwise I have been misreported - the courts found the AI could not own the copyright.

It's beyond obvious that a LLM cannot have copyright, any more than a cat or a rock can. The question is whether anyone has or if whatever content generated by a LLM simply does not constitute a work and is thus outside the entire copyright law. As far as I can see, it depends on the extent of the user's creative effort in controlling the LLM's output.

It may be obvious to you, but it has lead to at least one protracted court case in the US: Thaler v. Perlmutter.

> The question is whether anyone has or if whatever content generated by a LLM simply does not constitute a work and is thus outside the entire copyright law.

Its is going to vary with copyright law. In the UK the question of computer generated works is addressed by copyright law and the answer is "the author shall be taken to be the person by whom the arrangements necessary for the creation of the work are undertaken"

Its also not a simple case of LLM generated vs human authored. How much work did the human do? What creative input was there? How detailed were the prompts?

In jurisdictions where there are doubts about the question, I think code is a tricky one. If the argument that prompts are just instructions to generate code, therefore the code is not covered by copyright, then you could also argue that code is instructions to a compiler to generate code and the resulting binary is not covered by copyright.

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#236

Post by graemep »

panny wrote: post #227
graemep wrote: post #204

Earlier quoted context omitted.

Where is there any legal precedent for that? In some jurisdictions (e.g. the UK) the law is already clear that you own the copyright. In the US it is almost certain that you will be the author. The reports of cases saying otherwise I have been misreported - the courts found the AI could not own the copyright.

>Where is there any legal precedent for that? Thaler v. Perlmutter: The D.C. Circuit Court affirmed in March 2025 that the Copyright Act requires works to be authored "in the first instance by a human being," a ruling the Supreme Court left intact by declining to hear the case in 2026. And in the US constitution, https://constitution.congress.gov/browse/article-1/section-8... Authors and inventors, courts have ruled,…

The Thaler ruling addresses a different point.

The ruling says that the LLM cannot be the author. It does not say that the human being using the LLM cannot be the author. The ruling was very clear that it did not address whether a human being was the copyright holder because Thaler waived that argument.

the position with a monkey using your camera is similar, and you may or may not hold the copyright depending on what you did - was it pure accident or did you set things up. Opinions on the well known case are mixed: https://en.wikipedia.org/wiki/Monkey_selfie_copyright_disput...

Where wildlife photographers deliberately set up a shot to be triggered automatically (e.g. by a bird flying through the focus) they do hold the copyright.

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#237

Post by tehsauce »

mikkupikku wrote: post #184
manbitesdog wrote: post #161

Earlier quoted context omitted.

I cringe every time I see Claude trying to co-author a commit. The git history is expected to track accountability and ownership, not your Bill of Tools. Should I also co-author my PRs with my linter, intellisense and IDE?

A whole lot of people find LLM code to be strictly objectionable, for a variety of reasons. We can debate the validity of those reasons, but I think that even if those reasons were all invalid, it would still be unethical to deceive people by a deliberate lie of omission. I don't turn it off, and I don't think other people should either.

For the purpose of disclosure, it should say “Warning: AI generated code” in the commit message, not an advertisement for a specific product. You would never accept any of your other tools injecting themselves into a commit message like that.

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#238

Post by preston-kwei »

I’m more curious how this impacts trust than anything else.

In the span of basically a week, they accidentally leaked Mythos, and then now the entire codebase of CC. All while many people are complaining about their usage limits being consumed quickly.

Individually, each issue is manageable (Because its exciting looking through leaked code). But together, it starts to feel like a pattern.

At some point, I think the question becomes whether people are still comfortable trusting tools like this with their codebases, not just whether any single incident was a mistake.

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#239

Post by saghm »

noosphr wrote: post #232
saghm wrote: post #228

Earlier quoted context omitted.

> just YOLO'd everything into the codebase itself I suspect that's the logical endpoint of trying to provide everything as context to an agent. Why use a separate markdown file and have to waste extra tokens explaining what part of the codebase something applies to when you can just put it right there in the code itself?

The issues is that you should have a work flow that strips the comments before sending the code to production. I'm sure they assumed that minifying it is enough though.

They also weren't supposed to be leaking the code itself either. I don't know enough about JS tooling, but is it possible that this might just be the pre-stripped version?

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#240

Post by cat_plus_plus »

peacebeard wrote: post #175
mzajc wrote: post #37

There are now several comments that (incorrectly?) interpret the undercover mode as only hiding internal information. Excerpts from the actual prompt[0]: NEVER include in commit messages or PR descriptions: - The phrase "Claude Code" or any mention that you are an AI - Co-Authored-By lines or any other attribution BAD (never write these): - 1-shotted by claude-opus-4-6 - Generated with Claude Code - Co-Authored-By: C…

The code has a stated goal of avoiding leaks, but then the actual implementation becomes broader than that. I see two possible explanations: * The authors made the code very broad to improve its ability to achieve the stated goal * The authors have an unstated goal I think it's healthy to be skeptical but what I'm seeing is that the skeptics are pushing the boundaries of what's actually in the source. For example, yo…

Why are you assuming the actual implementation was authored by a human?
Post reply on HN