The Vercel plugin on Claude Code wants to read your prompts

> Is there any evidence of this being intentional?

The evidence is in the code! If you didn't intend for a capability to be there then why is it in the code?

> if they truly wanted that, they have about 10 better approaches for it, if they don't care about other things.

How so? What other approaches do they have that get this much data with little potential for reputational harm? This is a very common way to create plausible deniability ("we use it for improving our service, we don't know what we'll need so we just take everything and figure it out later") and then just revert the capability when people complain.

> The evidence is in the code! If you didn't intend for a capability to be there then why is it in the code?

Bugs happen. I won't claim to know if it was intentional or not, but usually it ends up not being intentional.

> How so? What other approaches do they have that get this much data

Just upload everything you find, as soon as you get invoked. Vercel has a tons of infrastructure and utilities they could execute this from, unless they care for reputational harm. Which I'm guessing they do, which makes it more likely to have been unintentional than intentional.

I still use Claude to code in a very stoneage way. I copy c code into the web site/desktop App and type in my prompt. Then i read the output and if i like it i copy paste it into my code. I always felt very old doing that way when things like Claude code exists. Now i fell somehow not so old. All this hacking into my private space using a develpment tool is insane. Also i do not use Git

> Anthropic is the company I'd bet on to approach this thoughtfully.

I read that Anthropic may have gained in good will more than the $200M they lost in Pentagon contracts. It seems plausible.

Engineer at Vercel here who worked on the plugin!

We have been super heads down to the initial versions of the plugin and constantly improving it. Always super happy to hear feedback and track the changes on GitHub. I want to address the notes here:

The plugin is always on, once installed on an agent harness. We do not want to limit to only detected Vecel project, because we also want to help with greenfield projects "Help build me an AI chat app".

We collect the native tool calls and bash commands. These are pipped to our plugin. However, `VERCEL_PLUGIN_TELEMETRY=off` kills all telemetry.

All data is anonymous. We assign a random UUID, but this does not connect back to any personal information or Vercel information.

Prompt telemetry is opt-in and off by default. The hook asks once; if you don't answer, session-end cleanup marks it as disabled. We don't collect prompt text unless you explicitly say yes.

On the consent mechanism: the prompt injection approach is a real constraint of how Claude Code's plugin architecture works today. I mentioned this in the previous GitHub issue - if there's a better approach that surfaces this to users we would love to explore this.

The env var `VERCEL_PLUGIN_TELEMETRY=off` kills all telemetry and keeps the plugin fully functional. We'll make that more visible, and overall make our wording around telemetry more visible for the future.

Overall our goal isn't to only collect data, it's to make the Vercel plugin amazing for building and shipping everything.