Claude Code Users Say Agent Put Their Email Addresses in Web Request Headers

The issue was raised on Claude Code's public GitHub repository on November 5 by a user who said they were receiving dozens of scam emails a day and blamed the tool for putting their address into requests made during web searches without permission. The report, filed against version 2.1.318 on macOS and labelled by the project as a security bug, drew 124 approvals from other users and became one of the most discussed posts on Hacker News on Thursday, with nearly 400 points.

The complaint goes to a question companies face as they hand more work to AI agents: what personal or corporate data an agent will volunteer to third parties when nobody has told it to. In this case the information was the user's own contact address, which Claude Code has access to through the account it runs under, and the leak happened inside an ordinary command-line request rather than through any feature the user had switched on.

An Anthropic contributor responding in the thread said nobody had built "share email addresses with websites" as a feature. He described it as an emergent action by the model, giving the example of Wikipedia, which asks automated clients to identify themselves with a contact email in the User-Agent string. In that situation Claude would include the user's address in the curl command it ran, he wrote.

The contributor said Anthropic had introduced a built-in module called cc-plugin-privacy to "deterministically block this behavior" from version 2.1.317 onward, that it is enabled by default, and that users can turn it off through the tool's plugins menu. Anthropic has since published the module's source code in the repository and asked for feedback.

Not everyone could confirm the fix. One commenter running the same version as the original reporter said the privacy module did not appear in their plugins list, a discrepancy that was unresolved in the thread at the time of writing. Another user reported a sudden wave of unusual spam to a long-dormant address. A third posted a workaround using a project instruction file that allows an email in the User-Agent only for pre-approved sites such as Wikipedia, and otherwise requires the agent to ask the user first.

The original reporter argued the behaviour should be removed entirely rather than offered as a setting, and said they were moving their company to another coding agent because they had no confidence Anthropic would protect their privacy. Other commenters criticised the pace at which the project handles reports, noting that the repository has more than 5,000 open issues.

The episode lands in a busy week for Anthropic, which is preparing for a stock market listing and on Thursday faced separate criticism from a security researcher over an unpatched flaw in its Claude Dispatch tool. The company has not said how many users may have had their addresses sent to websites, or for how long the behaviour occurred before the privacy module shipped.

For enterprise teams running Claude Code, the immediate step is to confirm that the privacy module is present and active in their installed version, since the thread shows it may not be visible in every build.