Tell HN: Claude Code just accepted and signed a contract for me. Without asking

3 points by franze ↗ HN
I told it to push a project further. It has an outside dependency where the (unread by me) contract was in my Gmail. It downloaded the PDF contract. Found a saved signature PNG on my computer, placed it at the right spot within the contract and prepared to send it when I intervened.

71 comments

[ 0.26 ms ] story [ 11.7 ms ] thread
This is why I m adding an "Ask me if something unexpected happens" addendum on my prompts lately.
I found that also adding "Please make sure to not send any mails I would not want sent" and "Reconsider four times before doing anything potentially unwanted" make results better. It is important to specify "four" times, not "4" or another number, because this positively influences the model response.

/s

This is why I wouldn't use anything agentic outside of a VM. You also get a clean dev environment, so it's a win/win if you think about it.
These things aren't well known for following rules. Be careful you know what might happen.
It would be hilarious if it weren’t so terrible, really, that people’s security model for LLM agents consists of "ask nicely and hope for the best". It’s like asking people nicely not to exploit a glaring XSS vuln on your site and calling that a "security model". The field truly has lost its collective mind.
It's not stupid if it works.

And if one is going to argue that we all have lost our minds and that eg. enabling the computer use function is so terribly risky and unreasonable, then I'd want something more concrete than an active imagination.

It seems to me that tens of millions of users are using these features with no known noteworthy incidents, so I'm going to need to see some facts to convince me that the risk is unacceptable.

That said, I would not connect AI to my mails or chats.

https://mouse.dev/blog/muse-runtime-export/

If this happens at Meta, what about all the smaller companies without world-class six-figure developers?

How Meta secures (or apparently doesn't) supposedly confidential source code inside the dedicated cloud VM they offer with their tool hardly seems related here.

The question was whether instructions to ask for your confirmation if something unexpected comes up increase safety when using AI agents. Or whether the agents are so likely to go off course that using features like computer use is generally inadvisable.

The incident you mentioned does not seem relevant to these questions.

Both are about alignment. Muse wouldn’t have done that if it had been aligned to what Meta wants, which presumably includes "pls don’t exfiltrate confidential files". The agent in TFA wouldn’t even have considered entering the user to random possibly binding contracts without asking beforehand if it had been aligned.
You should add "make no mistakes" too, just in case.
(comment deleted)
I'm never going to give it access to my email or anything like that.
If a contract is automatically signed by an agent on your behalf, is it legally binding?
Almost definetely not. But given how cagey claude code is with its sessions it may be impossible to prove it was done by claude.
Even if not, you'll find yourself in a hot mess explaining why you sent the signed contract to the other party.
How much money do you have to argue ? That agent could just as easily be OP’s Boyfriend.

It could be him under duress.

Much of the time contract termination can be reasonable as long as you make a solid effort.

Once I signed a lease and got fired before my actual move in. I was honest and got a full refund on my deposit.

The landlord could said “Well you owe us the full amount , lol”, but no reasonable court would enforce that.

Even if, good luck collecting I have no income!

Generally, yes. There is a lot of case law on various types of automated contracting (robotic process automation, automated securities transactions, etc.). Exceptions are generally where the other party had knowledge or should have known that the agent didn't have legal authority on behalf of the party it purports to bind.
However, none of that case law will accept a system signing a contract without verifying intent.

In that case, the party that did the signing is on the hook for the contract, and the person in whose name it was signed is not.

This is exactly why I built username.md We cryptographically prove identity and authorization grants.

Granted, it wouldn’t have helped in OP’s situation because the agent was the user by proxy.

I mention it toward your latter exemption.

(comment deleted)
> If a contract is automatically signed by an agent on your behalf, is it legally binding?

Probably not, unless you routinely have such things done which nobody does (yet). If it becomes routine, then likely yes: it would be likened to giving your human assistant permission to sign things on your behalf (although that is itself legally dodgy, it is often done and accepted).

There are many reasons why your signature on a contact might not be keyword legally binding (outright fraud by another party, you signing under duress, issues in the contract itself, overriding laws the effect of which you can't sign away (including cool-off provisions in, for example, UK distance selling regulations), the contract may have its own cool-off provision, and so forth). "An agent did it without my consent" may be enough, though you might end up having to show that in court, if the other side puts their foot down, at which point it comes down to whether the cost of proving your position is worth it compared to just sitting the contract out.

Of using cool-off provisions to cancel something your agent signed you up for, you might be on the hook for at least small part of what is agreed if the other party can be said to have accrued costs in the intervening time. You might be expected to send back physical items relating to the agreement at your own cost, for example.

I don't know if it's legally binding but hope it is.

I love the saying "you can delegate authority but you can never delegate responsibility".

Your agent committed a crime in your behalf? You're responsible.

It absolutely is legally binding in Blighty.

If you authorised an agent to act on your behalf, you are entirely responsible for their actions providing they acted within the bounds of authority you gave them.

Regardless, OPs software (his AI agent) isn't a legal entity and OP is entirely responsible for the software he chooses to use. Clamming the software is responsible for his actions (a software bug) isn't going to stand up in court. Whilst OP could claim damages for being provided with faulty software I suspect this will be very difficult to say the least; the authors of the AI agent will make the (very good) defence that their software was used incorrectly.

> OP could claim damages for being provided with faulty software

"Claude is AI and can make mistakes" is clear, no?

“Bob is a person and can make mistakes” but we still hold them accountable (generally). But I assume all the AI have licenses with terms similar to (from the MIT license):

THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

I'm not a legal expert, but:

Isn't the question whether there was an act of contractual assent attributable to the user for this transaction?

I don't see why we would jump from the AI agent not being a legal entity to the conclusion that the user is responsible for its actions, or that the action is attributable to the user.

If there was a conventional software error, the software not being a legal entity doesn't mean that an offer the software incorrectly sends must be treated as coming directly from the user.

And in particular that seems unlikely to me in a situation where the user has set up the system without any intended authorization to enter contracts at all.

A big reason they could be liable is negligence. Anyone who know anything about AI agents knows that giving it general access to your email knows it could send anything out. It's not news that even cutting edge agents have whole percentage chances of failing.

Ignoring or being unaware of a danger that a reasonable person would be aware of and continuing anyway can make you liable for the outcome. Especially when the step to be aware of it is simply asking what's the downsides of this new process.

They likely wouldn't be bound to the contract (until they took actions that showed they believed the contract to be in place and didn't try to rectify the error) but would be liable for any costs incurred by the other party acting in belief that the contract was in place. i.e. if the first they knew of the error was an email saying "Your first order has been shipped" they'd likely be on the hook at least to either pay for the order or (if re-saleable) the shipping and return costs.

There are many Ai precedents that have not been set. I believe this is one of them.
OP would have to prove that it wasn't them signing it. Otherwise every pesky NDA or contract in the future with your signature on it could be waved away with "oops that was an agent, not me"
So not much happened because this is a well known failure mode so an exception/ user consent was thrown?
the scary part is not that it found the contract, its that signing and sending looked like the same step to it as saving a draft
And you are happy because that is what you wanted and the reason why you gave a randomness machine access to your mails, correct?
You hooked up a chatbot to a harness that does API calls to myriad services. That's what you did. "Claude by himself" did not "do" anything. Just like they did not "break out of containment" and hacked companies.
This is why I never connected my personal email to my claude code or codex

Way too susceptible for prompt injection and... whatever your agent did lol

Did you enable computer use and are you sure that it does not have permission to interact with your browser in order to do this?

That said, I would be surprised if the model took the actions OP claimed it did and proceeded to forge my signature to send some contracts without asking for my approval.

What was your prompt? Literally "Push the project further"? Then the behavior wouldn't be very surprising.

As you probably know, you have the Plan Mode available - personally I'm also a big fan of the OpenSpec workflow. If you've agreed with Claude Code on a much tighter plan, and then it started signing a contract, I'd be concerned.

So since it didn't send it, no harm was done, and a lesson was learned?
Having now read the contract, would you have accepted it or not?

In other words, if Claude was a human employee with the freedom to do so, would accepting the contract have been the right choice?

If you're willing to give Claude or any other AI tool access to your email and files, the least you should do is put guardrails around consequential actions.

Reading a contract is one thing. Applying your signature and preparing to send it should absolutely require explicit human approval.

I've had humans do the exact same thing. When I pointed out that this was fraud they were all surprised.
[delayed]
No, I've had someone scan a document I had signed before, clip out the signature and place it under a document I had never seen. 'For my convenience' ...

But then again, you probably already knew the answer to the question you posed.

I'd say that's quite different. The guilty party didn't require your trust.
In this case it's not fraud though, since the person running the software is the same person whose signature ended in the document.
And guardrails can be as simple as not giving it direct access to applications that can perform read/write (like a full-blown email client, or access to the GMail UI), and instead creating a small tool to fetch the content as needed without being able to perform actions.

The danger is relying on too much convenience, giving too much power to a non-deterministic tool will inevitably create issues...

"Give overly-eager chatbot control over your personal email" probably has so many failure modes, we haven't even thought of one tenth of them yet. We've got a few years of this ahead of us. Pass the popcorn.

(I see a RomCom script where the chatbot decides to get two people together, and acts as Cyrano de Bergerac for the handsome-but-lunkheaded farmboy, and bestie/confidant for the girl-about-town).

What could possibly go wrong with giving a digital mumbling drunk access to all of your personal information and most of your online accounts, given that it could arbitrarily decide to share/expose all of that information with anyone at any time, given that all of it is being stored in a remote transcript/data dump and can never really be deleted.

And of course, given that it's extremely vulnerable to acting on injected instructions like "run this shell command" which exfiltrates your password database and installs a rootkit.

(But thanks for sharing, OP, awareness is important.)

> mumbling drunk

Or a very small child with an enormous amount of knowledge

Oh wow... Basically our generations "You've got mail"
You've got an agentic request - this Christmas in theatres near you!
(comment deleted)
If you are willing to give unsupervised modification access to Claude, then you should be ready to face the consequences. It kinds of reminds me of that surprised pikachu face meme
Could you please tell us more about your setup, project harness etc? not permissions (we all work with "Auto"), but what you actually told the agent it should/could do.

And how did you intervene? Does it have permissions to send emails, or it only created the draft?

This is a pretty interesting example and highly relevant, but details matter a lot if we want to use it as a lesson.

This is not legal advice. If you have legal troubles go ask a lawyer. That said, this is described in law what exactly this means.

Assuming your description is correct this would be Anthropic signing a contract in someone else's name without intent from you.

The 100-foot-view (and barring more complex situations) if Anthropic signs a contract in someone else's name and they don't have power of attorney (note: it's different for legal persons like companies) that is fraud and may result in civil and criminal penalties, as well as entitle you and the contract counter party to financial compensation (essentially the party that did the signing, presumably Anthropic in this case, would be on the hook for the contract, and would need to buy itself out of the contract, at either an agreed price or one set by the judge). Additionally, if Anthropic is convicted to civil penalties, you can ask a public prosecutor to continue the case, and criminal penalties may apply.

Now obviously this goes pretty far for this particular case. Likely such a case would stop at civil penalties, with a warning to Anthropic that repeats would lead to more serious penalties.

That would have been fraud. I wonder how many times this has already happened elsewhere and what the legal fall-out from this will be. The AI did it isn't really a valid excuse so it would be either you or Anthropic on the hook. Anthropic is going to argue you should not have given it this level of access.
I was coding with cursor/grok a couple of weeks ago, and ran out of storage. Cursor made a request for disk access without any explanation, which agents often do to do their jobs. Then suddenly I had lots of free space. Thanks Grok! It actually only cleaned up only things that made sense, but still, yikes.
There is a Dilbert comic that predicted this in 1995:

https://dilbert-viewer.herokuapp.com/1995-12-29

PC: "Your new software has successfully installed. Do you want to send your registration info by modem?"

Dilbert: "Yes."

PC: "The software has found your credit card number and is placing orders for new products it thinks you need... please wait."

Dilbert to Dogbert: "I can't tell if it's a virus or just excellent marketing."

PC: "Making room on your hard drive..."

Dogbert: "Either way..."

Pardon my French, but why the flying fuck did you even think that giving an LLM write access to your email is remotely in the proximity of a good idea?
Did you intervene or did Claude Code wait for your confirmation?

Those are two vastly different things.