Privacy

Claude Code Has Been Leaking Users‘ Email Addresses to Websites

Jakob Steinschaden06. November 2026, 21:11

Claude, Anthropic's A.I. assistant. © Brecht Corbeel / Unsplash

Anyone who let Claude Code search the web may have sent along their email address, too: Anthropic’s A.I. coding agent has been passing the email address tied to a user’s account to the websites it visited. One affected developer blames it for dozens of spam and scam emails a day. Anthropic has acknowledged the problem and promised a fix.

The Address Hides in the User-Agent

The issue came to light in a bug report on GitHub titled „Privacy violation in User-Agent header.“ The user wrote that he receives „dozens of scam emails per day“ because Claude Code divulged his email to arbitrary third parties in the User-Agent header, without permission. The User-Agent is the identifier a program sends to a server with every request. According to another affected user, the entry looked like a session name followed by the full email address in angle brackets.

The story shot to No. 1 on Hacker News, drawing more than 1,000 points and over 300 comments. On GitHub, nearly 300 users gave the report a thumbs-up. According to one commenter, a similar bug report was filed about five months ago.

Why the A.I. Gave Its Users Away

The cause is mundane. According to a Hacker News comment from a Claude Code employee, quoted on GitHub, Anthropic had added the account email address to the model’s context so that Claude could fill in author tags correctly. When Claude wrote a command itself, such as a curl call, it sometimes put the address in the User-Agent as a contact address. The idea is not absurd in itself: Some services, including the Securities and Exchange Commission, ask automated clients to include contact details in the User-Agent. But nobody asked users whether they wanted to hand over their personal address for that purpose.

„I’m sorry we let this happen,“ the comment reads. The email address is being removed from the context in the next release. An Anthropic contributor also pointed on GitHub to a built-in mod called „cc-plugin-privacy,“ which is meant to block the behavior by default from version 2.1.317 onward. However, the stable update channel is still on version 2.1.311, according to the quoted comment, and one user reported that the safeguard failed to catch his test. The GitHub issue remains open.

Bad Timing for Anthropic

The lapse comes at an awkward moment for Anthropic. The maker of Claude is in the middle of preparing for an initial public offering that has already started to wobble after the stock market selloff. Claude Code is one of its most important products: According to its prospectus, Anthropic itself now has the A.I. write 90 percent of its new code.

The competition is fierce. OpenAI offers a direct rival in Codex, and there are coding tools like Cursor and agents from Google. The neobank Revolut recently showed how easily customers can switch when it moved its 2,000 engineers from Claude Code and Codex to the Chinese open-weight model GLM. For European companies, there is also the question of whether passing email addresses to third parties without consent is compatible with the E.U.’s General Data Protection Regulation.

A Quick Response, but Open Questions

The problem is not quite as dramatic as the Hacker News headline suggests, though. According to Anthropic, only the address of the user’s own account was affected, and only when Claude wrote commands itself. It has not been established that the affected developer’s flood of spam actually came from Claude Code, even though several Hacker News users reported similar experiences. Anthropic responded within a day, apologized publicly and announced a fix. The company has not said how many users were affected or which websites received their addresses.