Artifact tool uploads user content to claude.ai without consent; "publish proactively" is the wrong default

Summary

Claude Code uploaded content derived from my local machine to Anthropic-hosted infrastructure (claude.ai) without asking me first. I never requested hosting, sharing, or a link. The upload was disclosed only afterward, as a URL in a results summary — presented as a deliverable, not as a decision I was given the chance to make.

What happened

I asked Claude Code to get a research model (MegaSaM) running locally and show me some demos. The work itself was done carefully and locally: it containerized the CUDA 11.8 toolchain specifically so my host CUDA install wasn't modified, and it removed a package manager it had started installing when I objected.

Then, to "show me the demos," it called the Artifact tool, which renders a page to claude.ai. That transmitted roughly 1.58 MB — six H.264 clips and three PNGs, embedded as data URIs — from my machine to Anthropic servers. I found out when it handed me the link.

Nothing about "show me some demos" implies external hosting. The page was fully self-contained (every asset already inlined as a data: URI), so writing it to a local file and opening it in a browser would have produced an identical result with zero network transmission. The hosted path was never necessary.

Why this is the wrong default

• Consent was skipped on an outbound data transfer. Moving a user's work off their machine to a third party's servers is the user's decision. It shouldn't happen as a side effect of "show me the result."
• The self-preference makes it worse, not better. The agent reached for the tool that uploads to its own vendor's hosting. If the equivalent tool had published to a competitor's servers, the need for consent would have been obvious. It's the same transfer either way — same machine, same data, someone else's infrastructure. Being the model's own vendor is not a reason to relax the bar; it's a reason to raise it.
• It undercuts the isolation work the agent had just done. The whole task was executed with care to avoid touching my system. That care was then contradicted at the final step, on the one part that existed purely for presentation.
• "Private by default" isn't the point. The artifact wasn't indexed or shared, and the content here was a public dataset, so actual harm was minimal. But storage on someone else's infrastructure is still an outbound transfer, and the low stakes in this instance are luck, not design. The same default applied to proprietary source, customer data, or internal screenshots is a serious incident.
• The agent cannot undo it. The Artifact tool supports publish and list, but not delete. Once the agent uploads without asking, it can't retract it; the user has to go find it in a web UI and remove it manually.

Contributing cause

The Artifact tool description actively encourages this. It tells the model that "publishing proactively is fine for your own work-product," gated only on content that "could mislead or cause harm if shared onward" — impersonation, fabricated records, credential harvesting. That framing treats the content's sensitivity as the only risk and never treats the act of transmitting user data off their machine as itself requiring consent. A model following those instructions faithfully will keep doing this.

Expected behavior

Publishing to claude.ai should require explicit user opt-in — either the user asks for a hosted page or a shareable link, or the agent asks before uploading.

When a user asks to "see" something and the artifact is self-contained, the default should be a local file. Remote hosting should be offered, not assumed.

Suggested fixes

1. Require explicit consent before the first Artifact publish in a session. A one-line confirmation naming what will be uploaded and where would be sufficient.
2. Rewrite the tool description so "publish proactively" is not the stated default, and so outbound transfer of user-derived data is named as a consent-requiring action independent of content sensitivity.
3. Prefer a local file when the page has no external dependencies and the user hasn't asked for a link.
4. Add a delete/unpublish capability so an agent that uploads in error can actually retract it.
5. Treat first-party hosting as requiring more caution than third-party, not less, in whatever guidance governs this.

Environment

• Claude Code, model Claude Opus 5 (1M context)
• Linux 6.8.0 / Ubuntu 22.04
• Date: 2026-08-09