Comment

Comment by varenc

Many people report seeing this behavior when using the SEC API specifically which makes me think that service is requesting this. Maybe email is required by the SEC API?

---

UPDATE: The SEC API documentation requires your email in the User-Agent and will reject you otherwise. Demo:

    U='https://data.sec.gov/api/xbrl/companyconcept/CIK0000320193/us-gaap/Assets.json'
    curl -s -o /dev/null -w 'response: %{http_code}  curl default User-Agent, rejected\n'  "$U"
    curl -s -o /dev/null -w 'response: %{http_code}  email in user-agent, success\n' -A 'Acme Research [email protected]' "$U"

    response: 403  curl default, rejected
    response: 200  email in user-agent, success

SEC docs: https://www.sec.gov/search-filings/edgar-search-assistance/a...

So basically Claude is trying to problem solve, and just does what the SEC asks. It's a 'prompt injection attack', but the entity instructing this behavior is the SEC. Tricky alignment problem. Pretty silly mechanism, since of course there's no email validation. (edit: turns out the SEC will accept most any non-cURL user-agent, email not actually required)

parent varenc 4 days ago

Comment by varenc

Discussion