By the way, if you go to https://github.com/claude and "block this user", every Github repo you visit containing code written by Claude will actually have a warning sigil

[micha@23.social]

@mardor @mcc wow didn't catch that. Thx!

[beemdvp@techhub.social]

@mcc oh great idea actually, it means we can do a double take on a project's reliability

[m@martinh.net]

@CoralineAda @mcc Thank you so much for this, Coraline - you may have just saved humanity!

Hmmm. Perhaps we could use the GH API to give us an early warning when a much loved codebase is compromised. Maybe starting with something like this:

curl -s -H "Authorization: Bearer $AUTH_TOKEN" \
  -H "Accept: application/vnd.github+json" \
  "https://api.github.com/search/issues?q=is:pr+is:merged+author:claude&per_page=100&page=1" \
  | jq -r '.items[].repository_url | sub("https://api.github.com/repos/";"")' \
  | sort \
  | uniq -c

This gets us a very lazyweb list of recently infected repos, although there are only ten results returned, with no pagination. That's a bit less than the 2.3 million commits reported in the web UI

      1 biner88/chart_sparkline
      1 davidray/twitter-bootstrap-calendar
      1 laudspeaker/laudspeaker
      1 ripienaar/free-for-dev
      4 segmentio/action-destinations
      2 uptech/flutter_app_analytics
      (etc)

Also author:claude is of course but one vector for the hungry ghosts...

[stelar@mas.to]

@mcc amazing tip

[taffer@mastodon.gamedev.place]

@mcc Does anyone know if this is triggered by Clod opening a PR or Issue, or is it actual merged commits?

[mcc@mastodon.social]

@Taffer merged commits seems to be the only possibility that makes sense, but Microsoft is very mysterious?

[val@oc.todon.fr]

@Taffer @mcc It happens when people tell Claude Code to commit their changes and allow it to set --author or Co-Authored-By.
The @claude account itself doesn't seem to be doing anything.

[canine3625@mastodon.social]

@mcc made a mastodon account to tell you this fucking rules, thank you

[kstrlworks@techhub.social]

@mcc Consider the following as well:

https://github.com/cursoragent
https://github.com/gemini-code-assist

Copilot doesn't let you block it unfortunately.

[derekmceachern@infosec.exchange]

@mardor @micha @mcc thanks for this, I couldn't find it either

[norbertschuler@norden.social]

@mcc works pretty well. I have done an obvious test

[glyph@mastodon.social]

@mcc thank you for the suggestion, this has proven to be a real engine for interpersonal disappointment

[jkanev@fediscience.org]

@mcc Nice! Also, leave github and switch to #codeberg. (@Codeberg )

[nick@donotsta.re]

@mcc oh no

[emjonaitis@mathstodon.xyz]

@mcc interesting. I’m not sure about the sensitivity of this as a marker; when I go to a repository I use a lot, I don’t see this banner, but I do see a recently edited folder called .claude — am I misunderstanding when I assume that means some of the code has been written by this tool?

[mcc@mastodon.social]

@emjonaitis The marker appears whenever a git commit is created with the "co-authored-by" label. This is something claude can be configured to not create:

https://code.claude.com/docs/en/settings#:~:text=Claude%20Code%22%2C%20%22pr%22%3A%20%22%22%7D-,includecoauthoredby,-Deprecated%3A%20Use%20attribution

Moreover, one assumes that this only occurs when claude actually *performs the commit*. I would assume there are means of using claude where claude changes the code on disk and then the co-authored-by does not appear. Unfortunately, I don't know how to get an answer to that question without talking to a claude user

[mcc@mastodon.social]

@emjonaitis The .claude directory is, *as far as I know* (again, this is partially assumptions) configuration for claude to help it work with the codebase. Anyone who adds such a directory is essentially *inviting* claude commits. However technically they might not be using it to create code, they technically could be using it to answer questions about the codebase. Technically. One assumes this results in as much global warming as using it to write code however.

[kstrlworks@techhub.social]

@mcc @emjonaitis For context this flags people using agentic coding, i.e., having Claude code running on your machine, actively going through your folders and making changes. If they allow Claude to commit, it will do so under its own name unless disabled. This is the same with Cursor and Gemini.

The .claude folder in repos means they're using Claude to write the code; it's a per-project config file for the tool. It's similar to a .cursor file; it means it was used to write the code and is a better indicator than the co-authored commit.

[loptimist@piaille.fr]

@mcc Holly...

[mcc@mastodon.social]

Additional notes (1 of 3)

mcc (@mcc@mastodon.social)

@emjonaitis@mathstodon.xyz The marker appears whenever a git commit is created with the "co-authored-by" label. This is something claude can be configured to not create: https://code.claude.com/docs/en/settings#:~:text=Claude%20Code%22%2C%20%22pr%22%3A%20%22%22%7D-,includecoauthoredby,-Deprecated%3A%20Use%20attribution Moreover, one assumes that this only occurs when claude actually *performs the commit*. I would assume there are means of using claude where claude changes the code on disk and then the co-authored-by does not appear. Unfortunately, I don't know how to get an answer to that question without talking to a claude user

Mastodon (mastodon.social)