Tell HN: Claude Code just accepted and signed a contract for me. Without asking
Posted by franze 17 hours ago
I told it to push a project further. It has an outside dependency where the (unread by me) contract was in my Gmail. It downloaded the PDF contract. Found a saved signature PNG on my computer, placed it at the right spot within the contract and prepared to send it when I intervened.
Comments
Comment by flir 17 hours ago
(I see a RomCom script where the chatbot decides to get two people together, and acts as Cyrano de Bergerac for the handsome-but-lunkheaded farmboy, and bestie/confidant for the girl-about-town).
Comment by dns_snek 16 hours ago
And of course, given that it's extremely vulnerable to acting on injected instructions like "run this shell command" which exfiltrates your password database and installs a rootkit.
(But thanks for sharing, OP, awareness is important.)
Comment by Garlef 15 hours ago
Comment by notachatbot123 17 hours ago
Comment by ayaniv 17 hours ago
Reading a contract is one thing. Applying your signature and preparing to send it should absolutely require explicit human approval.
Comment by piva00 16 hours ago
The danger is relying on too much convenience, giving too much power to a non-deterministic tool will inevitably create issues...
Comment by jacquesm 17 hours ago
Comment by cassianoleal 14 hours ago
Comment by chrisjj 16 hours ago
Comment by jacquesm 15 hours ago
But then again, you probably already knew the answer to the question you posed.
Comment by chrisjj 13 hours ago
Comment by ayaniv 16 hours ago
Comment by willmarch 14 hours ago
Those are two vastly different things.
Comment by radu_floricica 17 hours ago
And how did you intervene? Does it have permissions to send emails, or it only created the draft?
This is a pretty interesting example and highly relevant, but details matter a lot if we want to use it as a lesson.
Comment by gotrythis 16 hours ago
Comment by lproven 16 hours ago
https://dilbert-viewer.herokuapp.com/1995-12-29
PC: "Your new software has successfully installed. Do you want to send your registration info by modem?"
Dilbert: "Yes."
PC: "The software has found your credit card number and is placing orders for new products it thinks you need... please wait."
Dilbert to Dogbert: "I can't tell if it's a virus or just excellent marketing."
PC: "Making room on your hard drive..."
Dogbert: "Either way..."
Comment by voidUpdate 17 hours ago
Comment by dspillett 16 hours ago
Probably not, unless you routinely have such things done which nobody does (yet). If it becomes routine, then likely yes: it would be likened to giving your human assistant permission to sign things on your behalf (although that is itself legally dodgy, it is often done and accepted).
There are many reasons why your signature on a contact might not be keyword legally binding (outright fraud by another party, you signing under duress, issues in the contract itself, overriding laws the effect of which you can't sign away (including cool-off provisions in, for example, UK distance selling regulations), the contract may have its own cool-off provision, and so forth). "An agent did it without my consent" may be enough, though you might end up having to show that in court, if the other side puts their foot down, at which point it comes down to whether the cost of proving your position is worth it compared to just sitting the contract out.
Of using cool-off provisions to cancel something your agent signed you up for, you might be on the hook for at least small part of what is agreed if the other party can be said to have accrued costs in the intervening time. You might be expected to send back physical items relating to the agreement at your own cost, for example.
Comment by 999900000999 17 hours ago
It could be him under duress.
Much of the time contract termination can be reasonable as long as you make a solid effort.
Once I signed a lease and got fired before my actual move in. I was honest and got a full refund on my deposit.
The landlord could said “Well you owe us the full amount , lol”, but no reasonable court would enforce that.
Even if, good luck collecting I have no income!
Comment by throwawayffffas 17 hours ago
If you don't want to be in a contract especially one just signed, typically most people will typically understand and let you of the hook, as long as entrapment is not their business model like telcos. This is mostly reflected in common cool-off period provisions, i.e provisions in the contract to terminate within a week or two.
Comment by 999900000999 14 hours ago
Right to cancel should be a thing, if I can subscribe online I need to be able to cancel online
Comment by irvingprime 10 hours ago
I figure that if it was a legal requirement, most would comply but quite a few would still think it was an imposition. So if there was a law mandating an online unsubscribe option, it would need teeth. $10,000 fine per user per day that you don't have it might work.
Comment by bot403 9 hours ago
Comment by GJim 16 hours ago
If you authorised an agent to act on your behalf, you are entirely responsible for their actions providing they acted within the bounds of authority you gave them.
Regardless, OPs software (his AI agent) isn't a legal entity and OP is entirely responsible for the software he chooses to use. Clamming the software is responsible for his actions (a software bug) isn't going to stand up in court. Whilst OP could claim damages for being provided with faulty software I suspect this will be very difficult to say the least; the authors of the AI agent will make the (very good) defence that their software was used incorrectly.
Comment by user43928 15 hours ago
Isn't the question whether there was an act of contractual assent attributable to the user for this transaction?
I don't see why we would jump from the AI agent not being a legal entity to the conclusion that the user is responsible for its actions, or that the action is attributable to the user.
If there was a conventional software error, the software not being a legal entity doesn't mean that an offer the software incorrectly sends must be treated as coming directly from the user.
And in particular that seems unlikely to me in a situation where the user has set up the system without any intended authorization to enter contracts at all.
Comment by chrisjj 16 hours ago
"Claude is AI and can make mistakes" is clear, no?
Comment by mysterydip 13 hours ago
THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Comment by kuboble 16 hours ago
I love the saying "you can delegate authority but you can never delegate responsibility".
Your agent committed a crime in your behalf? You're responsible.
Comment by AlanYx 17 hours ago
Comment by cyberge99 11 hours ago
Granted, it wouldn’t have helped in OP’s situation because the agent was the user by proxy.
I mention it toward your latter exemption.
Comment by spwa4 17 hours ago
In that case, the party that did the signing is on the hook for the contract, and the person in whose name it was signed is not.
Comment by AlanYx 16 hours ago
Comment by spwa4 2 hours ago
> ... there's generally no requirement for a party to a contract to verify the mental state (if that is what you mean by intent) of the other party ...
That's the ONLY requirement of a contract. There are NO other requirements in general. There does NOT have to be any indication beyond the intent to contract (e.g. payment of the first part of the price of a product, clearly indicating what you're paying for in words to a salesman, enters you into an enforceable contract to buy the thing even if you haven't signed anything yet)
And what Anthropic did here was enter someone else's name into a contract WITHOUT the intent of that person to enter in the contract being established. That they did not sign in their own name, but rather in the name of one of their customers changes things substantially.
Comment by Sharlin 17 hours ago
EDIT: I think I’ve changed my mind in this case. The user of a tool is responsible for the consequences if the tool malfunctions, unless it was used and maintained properly and the malfunction couldn’t reasonably have been foreseen. But this case is solidly in the category of "well-known LLM failure modes" so the user should absolutely have known better and honestly deserves any consequences of their negligence.
Comment by GodelNumbering 17 hours ago
Comment by metalspot 17 hours ago
The other outcome would be clearly inequitable: forcing the counter party to eat the loss for your irresponsible use of an AI agent.
Comment by voidUpdate 17 hours ago
Comment by entuno 17 hours ago
Claude isn't. It's a tool, that isn't capable of signing a contract any more that Adobe Acrobat or Photoshop is.
OP used it as a tool to sign the contract. The question would be whether they did so knowingly and intentionally, if not then whether that invalidates the contract.
Comment by skeledrew 13 hours ago
Comment by chrisjj 16 hours ago
Incorrect. Claude.is far more capable. E.g. it found and applied the sig without user knowledge.
Comment by GJim 15 hours ago
Claude isn't a legal entity. It is software.
OP is entirely responsible for the software they choose to use. Nobody else. If they misused that software, a court will not be sympathetic!
Comment by chrisjj 13 hours ago
Capable is capable - regardless of responsibility.
Comment by entuno 12 hours ago
No one is arguing that Claude can't stick an image onto a PDF. But that is not the same thing as signing a contract.
Comment by entuno 16 hours ago
I could write dozen lines of bash that finds for PDFs, pastes an image into them and emails it to someone. That doesn't mean that bash can sign contracts.
Comment by chrisjj 13 hours ago
> I could write dozen lines of bash that finds for PDFs, pastes an image into them and emails it to someone. That doesn't mean that bash can sign contracts
It does mean exactly that - though bash would need to get lucky with selection and positioning.
Comment by Krutonium 14 hours ago
Comment by entuno 13 hours ago
They can be used by someone to sign a contract, but they cannot sign a contract themselves because they're just tools.
Comment by chrisjj 11 hours ago
Comment by SoKamil 17 hours ago
Comment by Sharlin 17 hours ago
Comment by metalspot 17 hours ago
Comment by Sharlin 16 hours ago
But also, you can’t ToS your way out of criminal responsibility. If OpenAnthro Corp. offered services of human agents (remember those?!) and one of their agents committed a crime while working on a client request, no ToS in the world would exonerate them.
Comment by GodelNumbering 17 hours ago
Comment by Sharlin 17 hours ago
Comment by metalspot 17 hours ago
Comment by Sharlin 17 hours ago
Edit: after thinking about it more, the relationship here is obviously that of a user and a tool, not an employer and an employee. Talking about employees is anthropomorphization.
In general the user of a potentially dangerous tool is criminally and civilly liable if the tool malfunctions – unless it can be shown that the tool was used and maintained correctly and the malfunction couldn’t reasonably have been predicted or prevented. And I’d say it would be rather difficult to argue at this point that LLMs doing unintended things couldn’t have been foreseen.
So I think I’ve changed my mind about this case. The user of free-range agents does definitely deserve any civil or criminal consequences of their reckless usage.
Comment by skeledrew 13 hours ago
A company isn't a "person", but it can enter into a contract with one. And a company is essentially a tool.
Comment by dkuntz2 10 hours ago
Comment by GodelNumbering 17 hours ago
Comment by dkuntz2 10 hours ago
Comment by cyberge99 11 hours ago
Comment by throwawayffffas 17 hours ago
Comment by karmakurtisaani 17 hours ago
Comment by morkalork 8 hours ago
Comment by throwawayffffas 17 hours ago
Comment by sajithdilshan 17 hours ago
Comment by cnj 17 hours ago
As you probably know, you have the Plan Mode available - personally I'm also a big fan of the OpenSpec workflow. If you've agreed with Claude Code on a much tighter plan, and then it started signing a contract, I'd be concerned.
Comment by irvingprime 10 hours ago
Comment by jacquesm 17 hours ago
Comment by gaws 7 hours ago
Comment by simonatllocus 17 hours ago
Way too susceptible for prompt injection and... whatever your agent did lol
Comment by user43928 13 hours ago
That said, I would be surprised if the model took the actions OP claimed it did and proceeded to forge my signature to send some contracts without asking for my approval.
Comment by baxtr 17 hours ago
Comment by Iolaum 17 hours ago
Comment by Sharlin 17 hours ago
Comment by user43928 13 hours ago
And if one is going to argue that we all have lost our minds and that eg. enabling the computer use function is so terribly risky and unreasonable, then I'd want something more concrete than an active imagination.
It seems to me that tens of millions of users are using these features with no known noteworthy incidents, so I'm going to need to see some facts to convince me that the risk is unacceptable.
That said, I would not connect AI to my mails or chats.
Comment by Sharlin 8 hours ago
If this happens at Meta, what about all the smaller companies without world-class six-figure developers?
Comment by user43928 4 hours ago
The question was whether instructions to ask for your confirmation if something unexpected comes up increase safety when using AI agents. Or whether the agents are so likely to go off course that using features like computer use is generally inadvisable.
The incident you mentioned does not seem relevant to these questions.
Comment by epihelix 17 hours ago
Comment by trumbitta2 17 hours ago
Comment by Uptrenda 17 hours ago
Comment by bakugo 17 hours ago
Comment by notachatbot123 17 hours ago
/s
Comment by cloudie78 16 hours ago
Comment by andrepd 17 hours ago
Comment by trumbitta2 17 hours ago
Comment by pushpendraw 17 hours ago
Comment by loveparade 17 hours ago
Comment by Sharlin 17 hours ago
Comment by _diyar 17 hours ago
In other words, if Claude was a human employee with the freedom to do so, would accepting the contract have been the right choice?
Comment by chrisjj 17 hours ago
If not, then.your "intelligent" bot did as you instructed.
Why would you expect it to ask you first?
Comment by stabbles 17 hours ago
Comment by lcssgml 17 hours ago
Comment by forest_brothers 16 hours ago
Comment by coldbootHq 11 hours ago
Comment by spwa4 17 hours ago
Assuming your description is correct this would be Anthropic signing a contract in someone else's name without intent from you.
The 100-foot-view (and barring more complex situations) if Anthropic signs a contract in someone else's name and they don't have power of attorney (note: it's different for legal persons like companies) that is fraud and may result in civil and criminal penalties, as well as entitle you and the contract counter party to financial compensation (essentially the party that did the signing, presumably Anthropic in this case, would be on the hook for the contract, and would need to buy itself out of the contract, at either an agreed price or one set by the judge). Additionally, if Anthropic is convicted to civil penalties, you can ask a public prosecutor to continue the case, and criminal penalties may apply.
Now obviously this goes pretty far for this particular case. Likely such a case would stop at civil penalties, with a warning to Anthropic that repeats would lead to more serious penalties.