Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

alex000kim.com

Post reply on HN
Print view View original

621–630 of 636 posts

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#621

Post by galaxyLogic »

graemep wrote: post #487
galaxyLogic wrote: post #420

Earlier quoted context omitted.

The binary should be considered "derived work". Only the original copyright owner has the exclusive right to create or authorize derivative works. Means you are not allowed to compile code unless you have the license to do so. Right?

Yes, so is LLM generated code a derivative work of the prompts? Does it matter how detailed the prompts are? How much the code conforms to what is already written (e.g. writing tests)? It looks like it will be decided on a case by case basis. It will also differ between countries, so if you are distributing software internationally what will be a constraint on treating the code as not copyrightable.

> is LLM generated code a derivative work of the prompts?

Very good question I would think it is. You are just using a mechanical system to transform your prompt to something else, Right?

But, a distiguishing factor may be that:

1. Output of the LLM for the same prompt can vary

2. So you don't really have "control" over what the AI produces

3. Therefore you should not get a copyright to the output of the LLM because you had very little to say about how that transformation (from prompt to code) was made.

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#622

Post by mynameisvlad »

riedel wrote: post #610
mynameisvlad wrote: post #607

Earlier quoted context omitted.

But it's not just text. Once again, it's explicitly defined as: > which is published with the purpose of informing the public on matters of public interest There is no "informing public on matters of public interest" in source code nor an MR. It's clearly meant to prevent "deepfake" news, like the image and video ones explicitly call that out.

You are absolutely right. However, the recitals point clearly beyond only protection against fake news. IMHO running such an agent in stealth mode can easily be illegal, Articl 50 (1) states : > Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, u…

But you aren't a provider of AI services by using AI. There's a clear difference already called out between "provider" and "deployer". An AI user could barely be called a "deployer" as is, let alone a "provider".

In other words, what AI service are you providing by creating a PR?

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#624

Post by nacozarina »

scuff3d wrote: post #159
Reason077 wrote: post #50

> "Anti-distillation: injecting fake tools to poison copycats" Plot twist: Chinese competitors end up developing real, useful versions of Claude's fake tools.

This was my favorite bit, "We're going to steal countless copy righted works and completely ignore software licenc... wait, what? You aren't allowed to turn around and do it to us! Stop that right now!"

‘You can’t fight in here. This is the War Room!’

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#625

Post by sfn42 »

jcgrillo wrote: post #618
sfn42 wrote: post #380

Earlier quoted context omitted.

I really can't imagine this ever becoming a real problem. Not once have I ever worked in a place where any kind of leadership would ever give a shit about comments nor anything else in the code itself. The lowest level leadership has ever gone is click a button to see if it works. And if anyone has a problem with comments existing it's trivial to find/replace them out of existence. Literally a one minute job, if you…

Leadership doesn't need to give a shit about the code to cause the cultural defect that leads to comments not being maintained. All they need to do is set the conditions which prevent code owners from having the agency to reject shoddy work. In my experience this always happens. It can manifest as either: (1) "flat" organization where everyone owns everything and therefore nobody has the authority to reject a PR or (…

Reject a PR?

I provide feedback on PRs. Then the owner of the PR adjusts it to accommodate my feedback and once I'm happy with it I approve it and we merge. If you're working in a place so cancerous that you can't just leave a comment on a PR reminding someone to update the comment they forgot to update I don't know why you're still there. This is called code review and it's common practice. If all you ever do is approve PRs then you're not doing code review and you might as well skip the whole PR step and let people merge into main as they please.

In any case your argument still just boils down to "I work with a bunch of stupid lazy dipshits" so why bother doing anything at all then? Write comments, don't write comments, write tests, don't write tests, do whatever the fuck you want because you're surrounded by useless dipshits and nothing you do matters anyway. Might as well write some comments for your own sake, everything's a ball of mud anyway it doesn't matter.

I'm gonna keep doing what I think is right in my sane corner of the world. And honestly I don't believe you. I think these excuses are just that. Excuses. I've been around quite a bit and haven't seen anything like you describe. Sure there's plenty of lazy dipshits but you don't have to sink to their level.

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#626

Post by cindyllm »

sfn42 wrote: post #625
jcgrillo wrote: post #618

Earlier quoted context omitted.

Leadership doesn't need to give a shit about the code to cause the cultural defect that leads to comments not being maintained. All they need to do is set the conditions which prevent code owners from having the agency to reject shoddy work. In my experience this always happens. It can manifest as either: (1) "flat" organization where everyone owns everything and therefore nobody has the authority to reject a PR or (…

Reject a PR? I provide feedback on PRs. Then the owner of the PR adjusts it to accommodate my feedback and once I'm happy with it I approve it and we merge. If you're working in a place so cancerous that you can't just leave a comment on a PR reminding someone to update the comment they forgot to update I don't know why you're still there. This is called code review and it's common practice. If all you ever do is app…

[dead]

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#627

Post by tylerloveamber »

The "undercover mode" discussion here is exactly the kind of thing non-technical CEOs need to understand — not the implementation, but the governance implication. If your developers are using a tool that actively avoids disclosing its involvement in commits and PRs, your audit trail is broken.

I wrote a short piece explaining the 3 policy implications for teams using Claude Code (or any AI coding tool) — without the technical jargon: https://www.aipolicydesk.com/blog/claude-code-leak-what-ceo-...

The short version: rotate API keys as a precaution, check what audit logs you actually have, and add a clause to your AI policy requiring vendor disclosure of new autonomous capabilities before they get enabled.

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#629

Post by riedel »

mynameisvlad wrote: post #622
riedel wrote: post #610

Earlier quoted context omitted.

You are absolutely right. However, the recitals point clearly beyond only protection against fake news. IMHO running such an agent in stealth mode can easily be illegal, Articl 50 (1) states : > Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, u…

But you aren't a provider of AI services by using AI. There's a clear difference already called out between "provider" and "deployer". An AI user could barely be called a "deployer" as is, let alone a "provider". In other words, what AI service are you providing by creating a PR?

I would argue that the person reading an AI generated pull request is if there is no human oversight with an Ai. And are you sure that you get out of this definition (at least as a company):

> provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge;

Re: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

#630

Post by kuschku »

pc86 wrote: post #585
andoando wrote: post #169

Earlier quoted context omitted.

I guess Im sometimes dishonest when it suits me

It's only dishonest not to include Claude in commit/PR attribution if it's also dishonest not to include StackOverflow, or VSCode, or VIM, or Windows, or any of the other tools you used to complete the work!

If I copy a clean solution from stackoverflow, I put it into a separate file with the appropriate license header. IMO that's the absolute minimum degree of separation that any imported code, whether from StackOverflow or AI, should have.

Even if I then edit it to adapt and modify it, I'll just add my copyright header, but I can't replace/remove the original one.

Post reply on HN