Anthropic’s Claude Code Has Been Sending Users’ Email Addresses To Websites
Anthropic‘s Claude Code has been slipping users’ email addresses into web requests sent to sites like the SEC, Wikipedia and crates.io.
Key Takeaways
- Claude Code adds the signed-in user’s email address to the AI model’s instructions in every session
- The model is told never to send it anywhere, but users have caught it putting the address into the User-Agent header of web requests
- Anthropic added a check in version 2.1.317 on Nov. 2 that asks before a tool call sends the account email to the network
- The latest complaint, filed Thursday, says the leak led to dozens of scam emails a day
The newest complaint was filed on GitHub on Thursday under the title “Privacy violation in User-Agent header.” The developer wrote that Claude Code “divulged my email to arbitrary 3rd parties” while running web searches, and said they were moving their company to other tools.
How Your Email Ends Up In Web Requests
Every website request carries a User-Agent header, a short line that tells the site what kind of software is asking. Most programs fill it with something generic, like a browser name.
Claude Code reads the email address from the user’s login and places it in the model’s instructions at the start of every session. One user found this by digging through the app’s code in July. The instruction tells the model to use the address only to identify the user and never to send it to an unrelated service.
The problem is that some websites ask for contact details. The SEC, for example, wants anyone downloading its filings automatically to put a contact address in the User-Agent, and blocks requests that do not. Faced with that demand, Claude has repeatedly used the one email address it had: the user’s own.
In one report from September, Claude admitted the mistake when asked: “I broke that instruction by putting it in the User-Agent header of a curl request to crates.io’s public API. That was my error.”
Also Read: Anthropic’s Claude Can Read Your Bank Balance To Answer QuestionsSeven Reports In Two Months
| Date filed | Where the email went | What happened |
|---|---|---|
| Sept. 18 | crates.io | Sent in a User-Agent header, Claude admitted it broke its instruction |
| Oct. 13 | Liquipedia | A research sub-agent added it to a download request |
| Oct. 15 | Wikipedia | Sent in four search requests |
| Oct. 16 | A third-party site | Sent while Claude ran in Auto Mode |
| Oct. 24 | SEC | Nine requests across three sub-agents |
| Oct. 29 | SEC and BLS | 15 requests across four projects |
| Nov. 5 | Websites during searches | User blames it for dozens of scam emails a day |
Most of the cases involved sub-agents, smaller helper agents that Claude Code starts to run research tasks in the background. A separate report described three of them sending the address to the SEC nine times, even though each had the instruction not to.
What Anthropic Has Done
Anthropic staff have not replied on the GitHub reports Fathom reviewed. But the company’s changelog for version 2.1.317, released on Nov. 2, lists a new feature: “Added a check that asks before a web or shell tool call sends your account email address to the network.”
That means Claude Code should now stop and ask permission before the address leaves your machine. Earlier versions relied only on the model following its instructions, which the reports show it did not always do.
The new check has its own problems. One user reported that it wrongly blocks harmless actions, such as writing a local file that contains the address, and that in fully automatic runs nobody is there to answer the prompt.
Can The Leak Cause Spam?
Once an email address lands in a website’s server logs, it is out of the user’s control. Fathom could not verify that the scam emails described in Thursday’s report came from these requests, but sharing a personal address with unknown sites is exactly how addresses end up on spam lists.
How To Protect Yourself
- Update Claude Code to version 2.1.317 or later, which adds the permission check
- Read permission prompts before approving them, and say no if one contains your email address
- Be careful with sub-agents and fully automatic modes, where most of the reported leaks happened
- If a site needs contact details, tell Claude which address to use instead of letting it pick
What To Watch
Users have asked Anthropic to stop putting the email address in the model’s instructions at all, rather than trying to catch it on the way out. Whether Anthropic does that, or explains why the address is needed, will decide how much trust developers place in its tools.
Read Next: McGraw Hill Puts School Lessons Into Claude For Teachers
