Wouldn't it be cool if you could chat with Claude knowing everything you send is automatically anonymized?
That's the question that keeps popping up in my head as I give Claude more and more access to tools and data. The power of a frontier model on your data with zero PII. That would be the dream.
So I spent a beautiful sunny weekend locking myself in front of my computer to try making that work.
Here's how I approached the task:
Take an open-source entity recognition model that can spot all personal data in a document (names, locations, phone numbers, etc.). I'm using GLiNER, a state-of-the-art model small enough to run fully locally in a matter of seconds.
Replace all detected entities with a placeholder (e.g. [PERSON_1], [LOCATION_2]) - so yes, technically it's pseudonymization - and save that mapping locally on your computer.
Put all that logic into a "hook", a mechanism supported by all major AI providers that lets you run deterministic scripts at certain events during an interaction with the AI agent. This is what makes the whole process automatic.
See, when I ask Claude to work on a document, it typically starts by triggering a Read operation. The hook intercepts that operation before your original data is sent.
It runs the pseudonymization and feeds the cleaned text back to Claude. All of that happens without you needing to do anything. Claude reasons over the pseudonymized content and never sees the original data.
In theory, it works. But I already noticed some limitations worth sharing (and I'd welcome some guidance if any of you have ideas).
First, Claude can read files in many creative ways beyond the Read operation I initially hooked into. Bash commands, python-docx, pandoc, even custom scripts written on the fly. Every time I think I've covered all the patterns, Claude surprises me with a new way of getting its hands on the original content. It's a bit of a cat-and-mouse game.
Then, the quality of detection. Even with the best model, some personal data slips through and some gets flagged when it shouldn't. For example, some street addresses were missed entirely until I added an extra rule-based check on top. Which makes me think the right approach is combining different tools rather than relying on a single one.
Not production-ready. Still a lot to clean up. But a problem worth solving in the open (and one that definitely feels solvable).
Shoutout to Jonas Achermann for his open-source anonymization tool (link in comment). And for those curious about the setup in the demo below, it's Lawve AI's VSCowork - a setup that turns VS Code into a minimal AI workspace ready for legal work.